{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/", "slug": "dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting", "url": "https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/" }, "title": "Match a Logic App alert parser to the action group's schema setting", "summary": "Choose the payload schema before relying on fields in a notification workflow.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:31:40+00:00", "modified_at": "2026-09-17T16:46:30+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 214, "potentially_affected": "Apply this review to a Logic App that consumes Azure Monitor alerts. Identify the action group, schema setting, alert types and fields that the workflow parses. Do not assume all incoming alerts match a sample payload merely because they reach the same workflow.", "dse_recommendation": "DSE recommends documenting the selected schema alongside the parser definition.", "primary_source": { "name": "Customize alert notifications by using Logic Apps - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-logic-apps", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s Logic Apps notification guide configures the action group with Enable common alert schema set to Yes. If it is set to No, the alert type determines the schema used. The action-group setting is therefore part of the workflow’s incoming payload contract. Microsoft Learn.

\n

Applicability

\n

Apply this review to a Logic App that consumes Azure Monitor alerts. Identify the action group, schema setting, alert types and fields that the workflow parses. Do not assume all incoming alerts match a sample payload merely because they reach the same workflow.

\n

DSE recommendation

\n

DSE recommends documenting the selected schema alongside the parser definition. Have the alert owner and workflow owner agree how each intended alert type supplies the required identifiers and timestamps. Keep representative sanitized payloads with the change record. Test schema changes in a separate approved action path before directing production alerts to a modified parser.

\n

Verification

\n

Send permitted test notifications for the intended alert types and inspect the workflow’s received payload. Confirm that parsing succeeds and the resulting message contains the correct resource, condition and time information. Exercise a malformed or unexpected-schema sample through a safe test path and verify visible failure handling. Preserve parser and action-group versions together for later troubleshooting.

\n

Official references

\n

Microsoft Learn: Customize alert notifications by using Logic Apps.

", "content_text": "Source facts\nMicrosoft’s Logic Apps notification guide configures the action group with Enable common alert schema set to Yes. If it is set to No, the alert type determines the schema used. The action-group setting is therefore part of the workflow’s incoming payload contract. Microsoft Learn.\nApplicability\nApply this review to a Logic App that consumes Azure Monitor alerts. Identify the action group, schema setting, alert types and fields that the workflow parses. Do not assume all incoming alerts match a sample payload merely because they reach the same workflow.\nDSE recommendation\nDSE recommends documenting the selected schema alongside the parser definition. Have the alert owner and workflow owner agree how each intended alert type supplies the required identifiers and timestamps. Keep representative sanitized payloads with the change record. Test schema changes in a separate approved action path before directing production alerts to a modified parser.\nVerification\nSend permitted test notifications for the intended alert types and inspect the workflow’s received payload. Confirm that parsing succeeds and the resulting message contains the correct resource, condition and time information. Exercise a malformed or unexpected-schema sample through a safe test path and verify visible failure handling. Preserve parser and action-group versions together for later troubleshooting.\nOfficial references\nMicrosoft Learn: Customize alert notifications by using Logic Apps.", "content_markdown": "## Source facts\n\nMicrosoft’s Logic Apps notification guide configures the action group with Enable common alert schema set to Yes. If it is set to No, the alert type determines the schema used. The action-group setting is therefore part of the workflow’s incoming payload contract. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-logic-apps).\n\n## Applicability\n\nApply this review to a Logic App that consumes Azure Monitor alerts. Identify the action group, schema setting, alert types and fields that the workflow parses. Do not assume all incoming alerts match a sample payload merely because they reach the same workflow.\n\n## DSE recommendation\n\nDSE recommends documenting the selected schema alongside the parser definition. Have the alert owner and workflow owner agree how each intended alert type supplies the required identifiers and timestamps. Keep representative sanitized payloads with the change record. Test schema changes in a separate approved action path before directing production alerts to a modified parser.\n\n## Verification\n\nSend permitted test notifications for the intended alert types and inspect the workflow’s received payload. Confirm that parsing succeeds and the resulting message contains the correct resource, condition and time information. Exercise a malformed or unexpected-schema sample through a safe test path and verify visible failure handling. Preserve parser and action-group versions together for later troubleshooting.\n\n## Official references\n\n[Microsoft Learn: Customize alert notifications by using Logic Apps](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-logic-apps)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/", "url": "https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Match a Logic App alert parser to the action group's schema setting", "item": "https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/", "url": "https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/", "headline": "Match a Logic App alert parser to the action group's schema setting", "description": "Choose the payload schema before relying on fields in a notification workflow.", "abstract": "Choose the payload schema before relying on fields in a notification workflow.", "articleBody": "Source facts\nMicrosoft’s Logic Apps notification guide configures the action group with Enable common alert schema set to Yes. If it is set to No, the alert type determines the schema used. The action-group setting is therefore part of the workflow’s incoming payload contract. Microsoft Learn.\nApplicability\nApply this review to a Logic App that consumes Azure Monitor alerts. Identify the action group, schema setting, alert types and fields that the workflow parses. Do not assume all incoming alerts match a sample payload merely because they reach the same workflow.\nDSE recommendation\nDSE recommends documenting the selected schema alongside the parser definition. Have the alert owner and workflow owner agree how each intended alert type supplies the required identifiers and timestamps. Keep representative sanitized payloads with the change record. Test schema changes in a separate approved action path before directing production alerts to a modified parser.\nVerification\nSend permitted test notifications for the intended alert types and inspect the workflow’s received payload. Confirm that parsing succeeds and the resulting message contains the correct resource, condition and time information. Exercise a malformed or unexpected-schema sample through a safe test path and verify visible failure handling. Preserve parser and action-group versions together for later troubleshooting.\nOfficial references\nMicrosoft Learn: Customize alert notifications by using Logic Apps.", "datePublished": "2026-09-17T16:31:40+00:00", "dateModified": "2026-09-17T16:46:30+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Match a Logic App alert parser to the action group's schema setting" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 214, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Customize alert notifications by using Logic Apps - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-logic-apps" } } ] } }