---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Event collection from Microsoft Azure Monitor

# Event collection from Microsoft Azure Monitor {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

The MID WebServer Event Collector enables you to collect JSON formatted event
messages sent from the Microsoft Azure portal.

## Before you begin

Ensure that the Event Management Connectors (sn_em_connector) plugin is
installed on the ServiceNow AI Platform instance.  
Ensure that you:

* Deploy and start the MID Server. See [MID Server
  configuration](https://www.servicenow.com/docs/access?context=c_MIDServerConfiguration&version=yokohama&pubname=yokohama-servicenow-platform&ft:locale=en-US) .
* Configure and start the MID Web Server. See [Configure the MID Web Server extension](https://servicenow-prod.fluidtopics.net/_6TI0U~gdVg0W_7HIWP7AA "The MID Web Server is a MID Server extension that enables developing REST APIs to send events and metrics to the MID Server. The extension is leveraged by other MID Server extensions, such as Metric Intelligence, MID WebService Event Listener, and the Agent Client Collector websocket endpoint extension.").
* Configure and start the MID WebService Event Collector. See [Configure the MID WebService Event Collector Context](https://servicenow-prod.fluidtopics.net/9hyUIqDCjbtMOV2bYDXigQ "Configure the MID WebService Event Collector Context to provide a URL method to push event messages from an external source to the MID Server.").
{#event-collection-MicrosoftAzure__ul_d21_gkf_cy}Role required: evt_mgmt_admin

## About this task

On the Azure portal, alert correlation rules are defined through the Correlate alerts setting within Alert Processing Rules. When Correlate alerts is
assigned on the Azure portal, the Azure Monitor alerts received on the ServiceNow® instance within 60 minutes are grouped using tag based alert clustering.

JSON formatted event messages are sent from Microsoft Azure. The MID Server transforms the collected event messages by parsing them
using the TransformEvents_MidAzureMonitor script include, located here: Event ManagementIntegrationsPushConnectors. In the Push Connectors page, click Azure Monitor Mid Push Connector.

The default format of the URL to push event messages from Microsoft Azure to the MID Server is
<kbd class="ph userinput">http://&lt;MID_Web_Server_User&gt;:&lt;MID_Web_Server_Password&gt;@&lt;MID_Server_IP&gt;:&lt;MID_Web_Server_Port&gt;/api/mid/em/inbound_event?Transform=TransformEvents_MidAzureMonitor</kbd>.  
{#event-collection-MicrosoftAzure__table_bbq_cmk_k2b__entry__2}

| Variable | Description |
|-|-|
| MID_Server_IP | IP address of the MID Web Server Extension. |
| MID_Web_Server_Port | Listening port of the MID Web Server Extension. |
| MID_Web_Server_User | Username for the MID Web Server Extension. |
| MID_Web_Server_Password | Password of the user of the MID Web Server. |
[Table 1. Variables in the default URL]

{#event-collection-MicrosoftAzure__table_bbq_cmk_k2b}

The following procedure describes the collection of JSON formatted event messages
using basic authentication.

## Procedure

1. In the Azure Monitor Portal, make sure the MID Server IP is accessible from the Azure portal and the MID rest point is accessible from Microsoft Azure or install the MID Server on a Azure VM and provide the Azure VM public address in the URL and allow the mid_web_Server_port in Azure VMNetworking SettingsInbound port rules.
2. Create an action group with a webhook and provide the rest endpoint as <kbd class="ph userinput">http://&lt;MID_Web_Server_User&gt;:&lt;MID_Web_Server_Password&gt;@&lt;MID_Server_IP&gt;:&lt;MID_Web_Server_Port&gt;/api/mid/em/inbound_event?Transform=TransformEvents_MidAzureMonitor</kbd>  
   Note:  
   For more information about adding a webhook to an action group, see [Create and manage action groups in the
   Azure portal](https://docs.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups) on the Microsoft documentation site.
3. In the Webhook section, make sure Yes is selected for the Enable the common alert schema option.
4. Navigate to AlertsManage Alert Rules.
5. Add the action group with the webhook to an alert rule.

## What to do next

If you want to send alert state changes on the ServiceNow instance from the ServiceNow alerts to the Azure Portal, you need to enable the Azure Monitor Bi-directional connector. For more information, see [Configure Azure Monitor Bi-directional connector](https://servicenow-prod.fluidtopics.net/EsshK09e1oYW6NSlMPPbdg "The Azure Monitor Pull connector sends information from ServiceNow Event Management to the Azure Portal. The pull connector sends the alert state changes from the ServiceNow environment to the Azure Portal.").

*[\>]: and then