Provide alert dimensions when linked storage removes a log query from the payload

Source facts

Microsoft documents that configuring linked storage for the Alerts data-source type removes the alert query from triggered log-search alert payloads. Alert details show a redaction comment instead. The source explains that the query resides in customer-managed storage and recommends alert dimensions to supply context. Microsoft Learn.

Applicability

Use this review for an existing or planned linked-storage arrangement for saved log-alert queries. Identify integrations that currently read the query from an alert payload. Keep the expected redaction behavior separate from whether the rule evaluated successfully and whether notification delivery worked.

DSE recommendation

DSE recommends reviewing the incident payload contract before changing linked storage. Identify the context responders need and choose appropriate, non-sensitive alert dimensions. Update consuming workflows to handle a redacted query explicitly rather than failing silently or fetching secrets into a ticket. Agree on an authorized route for analysts who need the saved query itself.

Verification

Trigger an approved representative alert and inspect the actual payload and downstream incident. Confirm the expected redaction, usable dimensions and successful routing. Verify that an authorized analyst can locate the query through the approved process. Retain a sanitized before-and-after payload comparison so the integration change is grounded in observed behavior.

Official references

Microsoft Learn: Use customer-managed storage accounts in Azure Monitor Logs.