Office 365 Message Center Critical alerting rule

Microsoft.SystemCenter.O365.Rules.MessageCenterAlertingRule.Critical (Rule)

When this rule receives a Message Center message of "Prevent or fix issues" category, it generates or updates a corresponding Critical Alert in the Operations Manager.

Knowledge Base article:

Summary

The rule calls Office 365 Management API to get the list of Messages for the Subscription from the Message Center.

Then, the rule generates a Critical Alert in the Operations Manager targeted to the Subscription for each Message.

The Messages are suppressed by means of a unique ID. If the Message data provided by the API changes, the rule updates the Alert payload and the context accordingly.

See the list of Messages in Office 365 Message Center

Element properties:

TargetMicrosoft.SystemCenter.O365.Subscription
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
Message Center
{0}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.SystemCenter.O365.DataSource.MessagesAlerts Default
Detection ConditionDetection System.ExpressionFilter Default
Alert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.SystemCenter.O365.Rules.MessageCenterAlertingRule.Critical" Enabled="true" Target="Microsoft.SystemCenter.O365.Subscription" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.SystemCenter.O365.DataSource.MessagesAlerts">
<TimeOut>300</TimeOut>
<IntervalSeconds>900</IntervalSeconds>
<SyncTime/>
<SubscriptionId>$Target/Property[Type="Microsoft.SystemCenter.O365.Subscription"]/SubscriptionId$</SubscriptionId>
<AuthorityUri>$Target/Property[Type="Microsoft.SystemCenter.O365.Subscription"]/AuthorityUri$</AuthorityUri>
<OfficeResourceUri>$Target/Property[Type="Microsoft.SystemCenter.O365.Subscription"]/OfficeResourceUri$</OfficeResourceUri>
<ManagementServiceUri>$Target/Property[Type="Microsoft.SystemCenter.O365.Subscription"]/ManagementServiceUri$</ManagementServiceUri>
<TenantId>$Target/Property[Type="Microsoft.SystemCenter.O365.Subscription"]/TenantId$</TenantId>
</DataSource>
</DataSources>
<ConditionDetection ID="Detection" TypeID="System!System.ExpressionFilter">
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">Property[@Name='EventType']</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Message</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">Property[@Name='Category']</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Prevent or fix issues</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</ConditionDetection>
<WriteActions>
<WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertOwner/>
<AlertMessageId>$MPElement[Name="Microsoft.SystemCenter.O365.MessageCenter.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/Property[@Name='Description']$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue>$Data/Property[@Name='IncidentId']$</SuppressionValue>
</Suppression>
<Custom1>$Data/Property[@Name='EventType']$</Custom1>
<Custom3>$Data/Property[@Name='IncidentStatus']$</Custom3>
<Custom4>$Data/Property[@Name='IncidentId']$</Custom4>
<Custom5>$Data/Property[@Name='Title']$</Custom5>
<Custom8>$Data/Property[@Name='View this message in Office 365 Message Center']$</Custom8>
<Custom9>$Data/Property[@Name='Additional Information']$</Custom9>
</WriteAction>
</WriteActions>
</Rule>