Bruno Gabrielli doesn’t want a static cut-off:
In this new blog post I am going to explain how to use dynamic threshold in log alerts. Think for a second, that you need to create an alert that must, at the same time, apply to more than one resource and react to different thresholds.
The solution is inside the power of the Kusto Query Language or KQL.
Click through for examples.