Does this tool connect to my Azure account?

No. This tool runs entirely in your browser and generates configuration JSON that you can copy and paste into your infrastructure-as-code templates, CLI commands, or cloud console. It never connects to any cloud account or sends data externally.

Are the generated configurations production-ready?

The tool produces syntactically valid configurations based on current Azure service specifications. Always review generated configs against your organization security policies and test in a non-production environment before deploying.

Azure Monitor Data Collection Rule Builder

MonitoringAzure

Build DCR configs for Azure Monitor Agent with performance counters, Windows event logs, KQL transforms, and Log Analytics destinations.

Azure Monitor Configuration

Build DCR configs for Azure Monitor Agent with performance counters, Windows event logs, syslog, KQL transforms, and Log Analytics destinations.

Required Fields

ruleNameresourceGroupdataSourcesdestinationsdataFlows

{
  "ruleName": "dcr-windows-perf-events",
  "resourceGroup": "rg-monitoring",
  "location": "eastus2",
  "kind": "Windows",
  "description": "Collect Windows performance counters and security events from Azure Monitor Agent.",
  "dataSources": {
    "performanceCounters": [
      {
        "name": "ds-perf-cpu-memory",
        "streams": ["Microsoft-Perf"],
        "samplingFrequencyInSeconds": 60,
        "counterSpecifiers": [
          "\\Processor(_Total)\\% Processor Time",
          "\\Memory\\Available MBytes",
          "\\Memory\\% Committed Bytes In Use",
          "\\LogicalDisk(_Total)\\% Free Space",
          "\\LogicalDisk(_Total)\\Disk Reads/sec",
          "\\LogicalDisk(_Total)\\Disk Writes/sec",
          "\\Network Interface(*)\\Bytes Total/sec"
        ]
      }
    ],
    "windowsEventLogs": [
      {
        "name": "ds-security-events",
        "streams": ["Microsoft-SecurityEvent"],
        "xPathQueries": [
          "Security!*[System[(EventID=4624 or EventID=4625 or EventID=4648 or EventID=4672 or EventID=4720 or EventID=4726)]]",
          "Security!*[System[(EventID=4732 or EventID=4756 or EventID=4740 or EventID=4767)]]"
        ]
      },
      {
        "name": "ds-system-events",
        "streams": ["Microsoft-Event"],
        "xPathQueries": [
          "System!*[System[(Level=1 or Level=2 or Level=3)]]",
          "Application!*[System[(Level=1 or Level=2)]]"
        ]
      }
    ],
    "syslog": [],
    "extensions": [
      {
        "name": "ds-change-tracking",
        "extensionName": "ChangeTracking-Windows",
        "streams": ["Microsoft-ConfigurationChange"],
        "extensionSettings": {
          "enableFiles": true,
          "enableSoftware": true,
          "enableRegistry": true,
          "enableServices": true,
          "fileSettings": {
            "fileCollectionFrequency": 3600
          }
        }
      }
    ]
  },
  "destinations": {
    "logAnalytics": [
      {
        "name": "dest-law-security",
        "workspaceResourceId": "/subscriptions/a1b2c3d4/resourceGroups/rg-monitoring/providers/Microsoft.OperationalInsights/workspaces/law-security-prod",
        "workspaceId": "workspace-guid-here"
      }
    ],
    "azureMonitorMetrics": {
      "name": "dest-metrics"
    }
  },
  "dataFlows": [
    {
      "streams": ["Microsoft-Perf"],
      "destinations": ["dest-law-security", "dest-metrics"],
      "transformKql": "source | where ObjectName == 'Processor' or ObjectName == 'Memory'"
    },
    {
      "streams": ["Microsoft-SecurityEvent"],
      "destinations": ["dest-law-security"],
      "transformKql": "source"
    },
    {
      "streams": ["Microsoft-Event"],
      "destinations": ["dest-law-security"],
      "transformKql": "source | where EventLevelName == 'Error' or EventLevelName == 'Critical'"
    }
  ],
  "tags": {
    "environment": "production",
    "managedBy": "monitoring-team"
  }
}

Generated Output

Output will appear here...

About This Tool

Build DCR configs for Azure Monitor Agent with performance counters, Windows event logs, KQL transforms, and Log Analytics destinations. This tool helps Azure engineers generate valid configurations quickly without consulting documentation, reducing errors and accelerating infrastructure deployment. All processing runs in your browser with no data sent to external servers.

When to Use This Tool

•Generating azure monitor data collection rule configurations for new infrastructure deployments.
•Validating existing configurations against best practices before applying changes.
•Learning Azure service configuration patterns through interactive examples.
•Accelerating infrastructure-as-code development by producing correct JSON/YAML starting points.

Frequently Asked Questions

Does this tool connect to my Azure account?: No. This tool runs entirely in your browser and generates configuration JSON that you can copy and paste into your infrastructure-as-code templates, CLI commands, or cloud console. It never connects to any cloud account or sends data externally.
Are the generated configurations production-ready?: The tool produces syntactically valid configurations based on current Azure service specifications. Always review generated configs against your organization security policies and test in a non-production environment before deploying.

Related Learning Guides

Cost Management Guide24 min read
Azure Monitor & Application Insights26 min read

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.