in Azure WAF/Alert - Process Azure FrontDoor Alerts/ProcessAFDAlerts.cs [49:90]
public static async Task<IActionResult> Run(
[HttpTrigger(AuthorizationLevel.Function, "get", "post", Route = null)]
HttpRequest req,
ILogger log)
{
// 1. Parse the alert message from the incoming request's body
var requestBody = await new StreamReader(req.Body).ReadToEndAsync();
AlertBody alertBody;
try
{
alertBody = JsonConvert.DeserializeObject<AlertBody>(requestBody);
}
catch (Exception e)
{
return new BadRequestObjectResult("Failed to deserialize the request body");
}
if (alertBody == null)
{
return new BadRequestObjectResult("AlertBody is null");
}
// 2. Extract info from the alert
var alertInfo = new AlertInfo()
{
Country = alertBody.data.alertContext.condition.allOf[0].dimensions[0].value
};
// 3. Check if the alert was fired/activated or resolved/deactivated
if (alertBody.data.essentials.monitorCondition == "Fired")
{
alertInfo.baselineThreshold = Convert.ToInt32(Convert.ToDouble(alertBody.data.alertContext.condition.allOf[0].threshold)) + 1;
await HandleAlertFired(log, alertInfo);
}
else
{
await HandleAlertResolved(log, alertInfo);
}
return new OkObjectResult("All done ... ");
}