Unable to Split Dimension by Azure Firewall Rule Collection

This is for Azure Government

Hi Yusko, Don (CTR) - FS, VA

You're absolutely right.

The issue occurs because the rule collection name isn’t appearing in the dropdown. The alert creation UI only shows dimension values that have appeared in logs or metrics within the past 24–48 hours. So, even if the value is valid, it won’t be recognized by the alert if it hasn’t been recently indexed.

Why your alert isn’t triggering: Azure metric alerts only recognize dimension values that have been observed in recent metric data. Since your custom dimension value hasn’t been seen yet, the alert isn’t firing.

You can either generate traffic to ensure the value gets indexed, or, more reliably, switch to log-based alerts using Kusto Query Language (KQL).

Example: Alert when a specific rule collection is triggered

AzureDiagnostics
| where Category == "AzureFirewallNetworkRule" or Category == "AzureFirewallApplicationRule"
| where ruleCollectionName_s == "YourRuleCollectionName"
| project TimeGenerated, Category, resource_s, source_s, destination_s, ruleCollectionName_s, ruleName_s, action_s, protocol_s

Example: Alert on denied traffic from a specific source

AzureDiagnostics
| where Category == "AzureFirewallNetworkRule"
| where ruleCollectionName_s == "YourRuleCollectionName"
| where action_s == "Deny"
| where source_s == "10.1.2.3"
| project TimeGenerated, source_s, destination_s, action_s, ruleName_s

How to setup log-based alert:

1.Go to Azure Monitor > Logs.

2.Paste and run the KQL query above.

3.Click "New Alert Rule” at the top.

4.Under Condition, set it to fire when results are greater than 0 over a selected time window (e.g., last 5 or 15 minutes).

5.Define an Action Group (email, webhook, etc.).

6.Save and enable the alert.

Please let me know if you face any challenge here, I can help you to resolve this issue further

If the comment was helpful, please click "Upvote"

We had hundreds of denies on the FW this morning and none of the rule collections showed up when creating the new alert rule. After the new alert rule was created and we still had another hours worth of denies on the FW but no alerts.

We do have an alert rule in place for applications, and we continued to receive those alerts both in Monitor and by email, but it is not split by any dimensions.

Wouldn't we see those alerts as it was an ongoing issue?

I'll look into using the KQL :)

Hi Yusko, Don (CTR) - FS, VA
Thanks for your acknowledgement. We look forward for your response.

Hi Yusko, Don (CTR) - FS, VA
Just want to check if the above solution worked for you or else please let us know if any help, we are always here to help whenever you need us.

If the comment was helpful, please click "Upvote"