/azure-sre-agent

Observability and AMBA Reference

Use Azure Monitor Baseline Alerts (AMBA) as the default monitoring baseline for new Azure SRE Agent implementations unless the customer has a stronger existing standard.

Core Pattern

1. Use AMBA to identify recommended Service Health, Resource Health, Activity Log, Metric, and Log Search alert categories.
2. Classify each alert before automation: investigate, notify, digest, tune, suppress, or candidate for later autonomy.
3. Create SRE Agent response plans only when the alert has a meaningful investigation path or safe remediation proposal.
4. Tune thresholds to workload SLOs and business criticality.
5. Use Review mode by default and enable reinvestigation cooldown for recurring Azure Monitor alerts.
6. Review noisy alerts and AAU cost before scaling response-plan coverage.
7. Query Application Insights customEvents for agent audit events before promoting AMBA-triggered workflows to Autonomous.

Policy-Deployed AMBA Checks

When AMBA is deployed by Azure Policy/ALZ patterns, verify:

• initiative and assignment scope
• assignment effect and disabled policies
• managed identity and remediation permissions
• action groups and alert processing rules
• exclusions, overrides, and resource selectors
• compliance/remediation state
• whether bulk remediation is being proposed as a production write action

Terraform/AVM Guidance

When using AMBA Terraform/AVM patterns:

• Keep customer-specific overrides outside upstream module source.
• Review plan output for policy assignments, action groups, alert rules, managed identities, and notification routing.
• Treat BYO managed identity, BYO notifications, telemetry settings, and exclusions as explicit design decisions.
• Validate management-group versus subscription scope before deployment.

SRE Agent Mapping

• Service Health/Resource Health: impact assessment and stakeholder digest.
• Activity Log delete/update: change validation, blast radius, rollback recommendation, KT DA/PPA if production-impacting.
• Metric alerts: resource triage, trend analysis, scaling/remediation proposal, and threshold tuning.
• Log Search alerts: fleet investigation, KQL summary, pattern detection, and knowledge capture.

Agent Audit Checks

Before expanding AMBA-to-response-plan coverage, review these audit signals:

1. AgentToolExecution volume by tool and custom agent.
2. ModelGeneration token trend for AAU and context growth.
3. IncidentActivitySnapshot counts for assisted versus mitigated incidents.
4. ApprovalDecision outcomes for unsafe or low-confidence remediation proposals.

Use the audit results to identify noisy alerts, expensive investigations, weak response-plan prompts, and workflows that are not safe for Autonomous mode.