[Azure AI Foundry] Add Alerting Rule Templates

packages/azure_ai_foundry/changelog.yml

@@ -1,3 +1,8 @@
+- version: "0.7.0"
+  changes:
+    - description: Add Alerting Rule Templates.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/15411
 - version: "0.6.1"
   changes:
     - description: Update overview and guardrails dashboard panel to use donut chart and fix protected_material_code filter.

packages/azure_ai_foundry/kibana/alerting_rule_template/latency_spike.json

@@ -0,0 +1,28 @@
+{
+  "id": "latency_spike",
+  "type": "alerting_rule_template",
+  "attributes": {
+    "name": "[Azure AI Foundry] Latency high",
+    "tags": ["Azure AI Foundry"],
+    "ruleTypeId": ".es-query",
+    "schedule": {
+      "interval": "5m"
+    },
+    "params": {
+      "searchType": "esqlQuery",
+      "timeWindowSize": 10,
+      "timeWindowUnit": "m",
+      "esqlQuery": {
+        "esql": "// Alert triggers when the response latency exceeds the recommended threshold value {5000ms} within the look back time window.\n// The alert is grouped by Model Deployment Name.\n// You can adjust the threshold value by modifying the time_to_response in the WHERE clause, which is specified in milliseconds.\nFROM metrics-azure.ai_foundry-default\n| KEEP azure.ai_foundry.time_to_response.avg, azure.dimensions.model_deployment_name, @timestamp\n| WHERE azure.dimensions.model_deployment_name IS NOT NULL\n| STATS time_to_response = MAX(azure.ai_foundry.time_to_response.avg) BY azure.dimensions.model_deployment_name\n| WHERE time_to_response > 5000\n| EVAL time_to_response = ROUND(time_to_response, 2)\n| SORT time_to_response DESC"
+      },
+      "groupBy": "row",
+      "timeField": "@timestamp"
+    },
+    "alertDelay": {
+      "active": 2
+    }
+  },
+  "managed": true,
+  "coreMigrationVersion": "8.8.0",
+  "typeMigrationVersion": "10.1.0"
+}

packages/azure_ai_foundry/kibana/alerting_rule_template/model_availability.json

@@ -0,0 +1,28 @@
+{
+  "id": "model_availability",
+  "type": "alerting_rule_template",
+  "attributes": {
+    "name": "[Azure AI Foundry] Model Availability above threshold",
+    "tags": ["Azure AI Foundry"],
+    "ruleTypeId": ".es-query",
+    "schedule": {
+      "interval": "5m"
+    },
+    "params": {
+      "searchType": "esqlQuery",
+      "timeWindowSize": 10,
+      "timeWindowUnit": "m",
+      "esqlQuery": {
+        "esql": "// Alert triggers when the model availability is less than the recommended threshold value {99%} within the look back time window.\n// The alert is grouped by Model Deployment Name.\n// You can adjust the threshold value by modifying the model_availability in the WHERE clause, which is specified in percent.\nFROM metrics-azure.ai_foundry-default\n| KEEP azure.ai_foundry.model_availability_rate.avg, azure.dimensions.model_deployment_name, @timestamp\n| WHERE azure.dimensions.model_deployment_name IS NOT NULL\n| STATS model_availability = MIN(azure.ai_foundry.model_availability_rate.avg) * 100 BY azure.dimensions.model_deployment_name\n| WHERE model_availability < 99\n| EVAL model_availability = ROUND(model_availability, 2)\n| SORT model_availability ASC"
+      },
+      "groupBy": "row",
+      "timeField": "@timestamp"
+    },
+    "alertDelay": {
+      "active": 3
+    }
+  },
+  "managed": true,
+  "coreMigrationVersion": "8.8.0",
+  "typeMigrationVersion": "10.1.0"
+}

packages/azure_ai_foundry/kibana/alerting_rule_template/provisioned_utilization.json

@@ -0,0 +1,28 @@
+{
+  "id": "provisioned_utilization",
+  "type": "alerting_rule_template",
+  "attributes": {
+    "name": "[Azure AI Foundry] Provisioned Utilization above threshold",
+    "tags": ["Azure AI Foundry"],
+    "ruleTypeId": ".es-query",
+    "schedule": {
+      "interval": "5m"
+    },
+    "params": {
+      "searchType": "esqlQuery",
+      "timeWindowSize": 10,
+      "timeWindowUnit": "m",
+      "esqlQuery": {
+        "esql": "// Alert triggers when the provisioned utilization exceeds the recommended threshold value {85%} within the look back time window.\n// The alert is grouped by Model Deployment Name.\n// You can adjust the threshold value by modifying the provisioned_utilization in the WHERE clause, which is specified in percent.\nFROM metrics-azure.ai_foundry-default\n| KEEP azure.ai_foundry.provisioned_utilization.avg, azure.dimensions.model_deployment_name, @timestamp\n| WHERE azure.dimensions.model_deployment_name IS NOT NULL\n| STATS provisioned_utilization = MAX(azure.ai_foundry.provisioned_utilization.avg) * 100 BY azure.dimensions.model_deployment_name\n| WHERE provisioned_utilization > 85\n| EVAL provisioned_utilization = ROUND(provisioned_utilization, 2)\n| SORT provisioned_utilization DESC"
+      },
+      "groupBy": "row",
+      "timeField": "@timestamp"
+    },
+    "alertDelay": {
+      "active": 2
+    }
+  },
+  "managed": true,
+  "coreMigrationVersion": "8.8.0",
+  "typeMigrationVersion": "10.1.0"
+}

packages/azure_ai_foundry/manifest.yml

@@ -1,7 +1,7 @@
-format_version: 3.3.2
+format_version: 3.4.0
 name: azure_ai_foundry
 title: "Azure AI Foundry"
-version: "0.6.1"
+version: "0.7.0"
 source:
   license: "Elastic-2.0"
 description: "Collects Azure AI Foundry logs and metrics"
@@ -14,7 +14,7 @@ categories:
   - security
 conditions:
   kibana:
-    version: "^9.0.0"
+    version: "^9.1.0"
   elastic:
     subscription: "basic"
 vars: