Set-AzDdosCustomPolicyMitigationRule

Module:

Az.Network Module

Updates a mitigation rule in an in-memory DDoS custom policy.

Syntax

Default (Default)

Set-AzDdosCustomPolicyMitigationRule
    -DdosCustomPolicy <PSDdosCustomPolicy>
    -Name <String>
    [-TrafficScope <String>]
    [-TcpPacketsPerSecond <Int32>]
    [-TcpConnectionsPerSecond <Int32>]
    [-UdpPacketsPerSecond <Int32>]
    [-DenyIpPrefix <String[]>]
    [-DenyGeoMatch <String[]>]
    [-PermitIpPrefix <String[]>]
    [-PermitGeoMatch <String[]>]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [-AcquirePolicyToken]
    [-ChangeReference <String>]
    [<CommonParameters>]

Description

The Set-AzDdosCustomPolicyMitigationRule cmdlet updates the explicitly specified properties of an existing named mitigation rule. Omitted parameters retain their existing values, a supplied list replaces that list, and an empty array clears that list. When both lists for an action are empty, that action is removed.

Deny matches drop traffic from matching sources. Permit matches skip source-level mitigations for matching sources, while destination-level mitigations still apply. Within one action, IP prefixes and geographic matches use OR semantics. Geographic matches use <Country>, <Continent>, or <Continent>.<Country> format.

Rule-name matching is case-insensitive, and response metadata and unmodified service-provided actions are preserved. The cmdlet does not update Azure. Pipe the returned policy to Set-AzDdosCustomPolicy to persist the change.

Examples

Example 1: Update and persist a TCP mitigation rule

$policy = Get-AzDdosCustomPolicy -ResourceGroupName "myRG" -Name "myPolicy"
$policy | Set-AzDdosCustomPolicyMitigationRule -Name "tcpRule" -TcpConnectionsPerSecond 15000 | Set-AzDdosCustomPolicy

This example updates only the TCP connection rate on tcpRule. The existing packet rate and source policy overrides are retained when the updated policy is persisted.

Example 2: Replace a Deny geographic match list

$policy = Get-AzDdosCustomPolicy -ResourceGroupName "myRG" -Name "myPolicy"
$policy | Set-AzDdosCustomPolicyMitigationRule -Name "tcpRule" -DenyGeoMatch "US", "Africa.ZM", "MX" | Set-AzDdosCustomPolicy

This example replaces the complete Deny geographic match list.

Example 3: Clear a Permit IP prefix list

$policy = Get-AzDdosCustomPolicy -ResourceGroupName "myRG" -Name "myPolicy"
$policy | Set-AzDdosCustomPolicyMitigationRule -Name "tcpRule" -PermitIpPrefix @() | Set-AzDdosCustomPolicy

This example clears the Permit IP prefix list while preserving the Permit geographic match list.

Example 4: Remove a TCP packet rate limit

$policy = Get-AzDdosCustomPolicy -ResourceGroupName "myRG" -Name "myPolicy"
$policy | Set-AzDdosCustomPolicyMitigationRule -Name "tcpRule" -TcpPacketsPerSecond $null | Set-AzDdosCustomPolicy

This example removes the TCP packet rate limit while preserving other rule properties.

Parameters

-AcquirePolicyToken

Acquire an Azure Policy token automatically for this resource operation.

Parameter properties

Type:	SwitchParameter
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ChangeReference

The change reference resource ID for this resource operation.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Confirm

Prompts you for confirmation before running the cmdlet.

Parameter properties

Type:	SwitchParameter
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	cf

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-DdosCustomPolicy

Specifies the DDoS custom policy object to modify.

Parameter properties

Type:	PSDdosCustomPolicy
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	True
Value from pipeline:	True
Value from pipeline by property name:	True
Value from remaining arguments:	False

-DefaultProfile

The credentials, account, tenant, and subscription used for communication with Azure.

Parameter properties

Type:	IAzureContextContainer
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	AzContext, AzureRmContext, AzureCredential

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-DenyGeoMatch

Specifies the replacement geographic match list for the Deny action. Matching traffic is dropped. Use <Country>, <Continent>, or <Continent>.<Country> format. Specify an empty array to clear this list. If omitted, the current list is retained.

Parameter properties

Type:	String[]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-DenyIpPrefix

Specifies the replacement IPv4 or IPv6 CIDR prefix list for the Deny action. Matching traffic is dropped. Specify an empty array to clear this list. If omitted, the current list is retained.

Parameter properties

Type:	String[]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Name

Specifies the name of the existing mitigation rule to update.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-PermitGeoMatch

Specifies the replacement geographic match list for the Permit action. Matching sources skip source-level mitigations, while destination-level mitigations still apply. Use <Country>, <Continent>, or <Continent>.<Country> format. Specify an empty array to clear this list. If omitted, the current list is retained.

Parameter properties

Type:	String[]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-PermitIpPrefix

Specifies the replacement IPv4 or IPv6 CIDR prefix list for the Permit action. Matching sources skip source-level mitigations, while destination-level mitigations still apply. Specify an empty array to clear this list. If omitted, the current list is retained.

Parameter properties

Type:	String[]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-TcpConnectionsPerSecond

Specifies the maximum new TCP connection rate per source IP address.

Parameter properties

Type:	Nullable<T>[Int32]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-TcpPacketsPerSecond

Specifies the maximum TCP packet rate per source IP address.

Parameter properties

Type:	Nullable<T>[Int32]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-TrafficScope

Specifies the traffic protocol to which the rule applies. If this parameter is omitted, the existing traffic scope is retained. Common values are Tcp and Udp.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-UdpPacketsPerSecond

Specifies the maximum UDP packet rate per source IP address.

Parameter properties

Type:	Nullable<T>[Int32]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Parameter properties

Type:	SwitchParameter
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	wi

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

PSDdosCustomPolicy

Outputs

PSDdosCustomPolicy

Related Links

• Get-AzDdosCustomPolicyMitigationRule
• Add-AzDdosCustomPolicyMitigationRule
• Set-AzDdosCustomPolicy
• Remove-AzDdosCustomPolicyMitigationRule