Event collection from Microsoft Azure Monitor

The MID WebServer Event Collector enables you to collect JSON formatted event messages sent from the Microsoft Azure portal.

Before you begin

Ensure that the Event Management Connectors (sn_em_connector) plugin is installed on the ServiceNow AI Platform instance.

Ensure that you:

• Deploy and start the MID Server. See MID Server configuration .

• Configure and start the MID Web Server. See Configure the MID Web Server extension.

• Configure and start the MID WebService Event Collector. See Configure the MID WebService Event Collector Context.

Role required: evt_mgmt_admin

About this task

On the Azure portal, alert correlation rules are defined through the Correlate alerts setting within Alert Processing Rules. When Correlate alerts is assigned on the Azure portal, the Azure Monitor alerts received on the ServiceNow® instance within 60 minutes are grouped using tag based alert clustering.

JSON formatted event messages are sent from Microsoft Azure. The MID Server transforms the collected event messages by parsing them using the TransformEvents_MidAzureMonitor script include, located here: Event Management > Integrations > PushConnectors. In the Push Connectors page, click Azure Monitor Mid Push Connector.

The default format of the URL to push event messages from Microsoft Azure to the MID Server is http://<MID_Web_Server_User>:<MID_Web_Server_Password>@<MID_Server_IP>:<MID_Web_Server_Port>/api/mid/em/inbound_event?Transform=TransformEvents_MidAzureMonitor.

Variable Description MID_Server_IP IP address of the MID Web Server Extension. MID_Web_Server_Port Listening port of the MID Web Server Extension. MID_Web_Server_User Username for the MID Web Server Extension. MID_Web_Server_Password Password of the user of the MID Web Server.

The following procedure describes the collection of JSON formatted event messages using basic authentication.

Procedure

1. In the Azure Monitor Portal, verify that the MID Server IP is accessible from the Azure portal and the MID rest point is accessible from Microsoft Azure.

2. Install the MID Server on an Azure VM, provide the Azure VM public address in the URL, and allow the mid_web_Server_port in Azure VM > Networking Settings > Inbound port rules.

3. Create an action group with a webhook and provide the rest endpoint as http://<MID_Web_Server_User>:<MID_Web_Server_Password>@<MID_Server_IP>:<MID_Web_Server_Port>/api/mid/em/inbound_event?Transform=TransformEvents_MidAzureMonitor

   Note: For more information about adding a webhook to an action group, see Create and manage action groups in the Azure portal on the Microsoft documentation site.

4. In the Webhook section, make sure Yes is selected for the Enable the common alert schema option.

5. Navigate to Alerts > Manage Alert Rules.

6. Add the action group with the webhook to an alert rule.

What to do next

If you want to send alert state changes on the ServiceNow instance from the ServiceNow alerts to the Azure Portal, you need to enable the Azure Monitor Bi-directional connector. For more information, see Configure Azure Monitor Bi-directional connector.

Parent Topic:Integrate with push connectors