# you can disable an alarm notification by setting the 'to' line to: silent

# Health check status (0-100%). Low is bad.
# AMBA: HealthCheckStatus < 100 is Sev1 (critical)

 template: am_app_service_health_check
       on: azure_monitor.app_service.health
    class: Availability
     type: Web Server
component: App Service
   lookup: average -5m unaligned of average
    units: percentage
    every: 1m
     warn: $this < (($status >= $WARNING)  ? (100) : (80))
     crit: $this < (($status == $CRITICAL) ? (80)  : (50))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Service health on ${label:resource_name}
     info: Health check status of App Service ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin

# HTTP 5xx server errors (rate).
# AMBA: Http5xx > 10 is Sev1

 template: am_app_service_http_5xx_rate
       on: azure_monitor.app_service.http_status
    class: Errors
     type: Web Server
component: App Service
   lookup: average -5m unaligned of 5xx
    units: responses/s
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (5)  : (10))
     crit: $this > (($status == $CRITICAL) ? (10) : (25))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Service 5xx errors on ${label:resource_name}
     info: HTTP 5xx server error rate on App Service ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin

# HTTP response time (seconds). High is bad.
# AMBA: HttpResponseTime average > 5s is Sev2

 template: am_app_service_response_time
       on: azure_monitor.app_service.response_time
    class: Latency
     type: Web Server
component: App Service
   lookup: average -5m unaligned of average
    units: seconds
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (3) : (5))
     crit: $this > (($status == $CRITICAL) ? (5) : (10))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Service response time on ${label:resource_name}
     info: Average HTTP response time of App Service ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin

# CPU utilization (percentage). High is bad.
# AMBA: CpuPercentage > 90 is Sev2

 template: am_app_service_cpu_utilization
       on: azure_monitor.app_service.cpu
    class: Utilization
     type: Web Server
component: App Service
   lookup: average -5m unaligned of average
    units: percentage
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (75) : (85))
     crit: $this > (($status == $CRITICAL) ? (85) : (95))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Service CPU on ${label:resource_name}
     info: CPU utilization of App Service ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin

# Request queue depth (absolute). High means saturation.
# AMBA: RequestsInApplicationQueue > 10 is Sev2

 template: am_app_service_request_queue
       on: azure_monitor.app_service.request_queue
    class: Workload
     type: Web Server
component: App Service
   lookup: average -5m unaligned of queued
    units: requests
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (10) : (25))
     crit: $this > (($status == $CRITICAL) ? (25) : (100))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Service request queue on ${label:resource_name}
     info: Requests queued in application queue of App Service ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin

# HTTP 4xx client errors (rate). Sustained high rates may indicate
# broken clients, missing endpoints, or auth problems.

 template: am_app_service_http_4xx_rate
       on: azure_monitor.app_service.http_status
    class: Errors
     type: Web Server
component: App Service
   lookup: average -5m unaligned of 4xx
    units: responses/s
    every: 1m
     warn: $this > (($status >= $WARNING) ? (50) : (100))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Service 4xx errors on ${label:resource_name}
     info: HTTP 4xx client error rate on App Service ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin

# HTTP 403 Forbidden spikes — may indicate WAF blocks or permission issues

 template: am_app_service_http_403_rate
       on: azure_monitor.app_service.http_error_detail
    class: Errors
     type: Web Server
component: App Service
   lookup: average -5m unaligned of 403_forbidden
    units: responses/s
    every: 1m
     warn: $this > (($status >= $WARNING) ? (10) : (25))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Service 403 forbidden on ${label:resource_name}
     info: HTTP 403 Forbidden response rate on App Service ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin

# HTTP 401 Unauthorized spikes — may indicate auth service failures

 template: am_app_service_http_401_rate
       on: azure_monitor.app_service.http_error_detail
    class: Errors
     type: Web Server
component: App Service
   lookup: average -5m unaligned of 401_unauthorized
    units: responses/s
    every: 1m
     warn: $this > (($status >= $WARNING) ? (10) : (25))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Service 401 unauthorized on ${label:resource_name}
     info: HTTP 401 Unauthorized response rate on App Service ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin