Alerts Suppression Rules - List

Service:

Defender for Cloud

API Version:

2019-01-01-preview

List of all the dismiss rules for the given subscription

GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview

With optional parameters:

GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview&AlertType={AlertType}

URI Parameters

Name	In	Required	Type	Description
subscriptionId	path	True	string (uuid)	The ID of the target subscription. The value must be an UUID.
api-version	query	True	string minLength: 1	The API version to use for this operation.
AlertType	query		string	Type of the alert to get rules for

Responses

Name	Type	Description
200 OK	AlertsSuppressionRulesList	Azure operation completed successfully.
Other Status Codes	Common.CloudError	An unexpected error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Get suppression alert rule for subscription, filtered by AlertType

Get suppression rules for subscription

Get suppression alert rule for subscription, filtered by AlertType

Sample request

HTTP

GET https://management.azure.com/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview

Go

package armsecurity_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/security/armsecurity"
)

// Generated from example definition: 2019-01-01-preview/AlertsSuppressionRules/GetAlertsSuppressionRulesWithAlertType_example.json
func ExampleAlertsSuppressionRulesClient_NewListPager_getSuppressionAlertRuleForSubscriptionFilteredByAlertType() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurity.NewClientFactory("20ff7fc3-e762-44dd-bd96-b71116dcdc23", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	pager := clientFactory.NewAlertsSuppressionRulesClient().NewListPager(nil)
	for pager.More() {
		page, err := pager.NextPage(ctx)
		if err != nil {
			log.Fatalf("failed to advance page: %v", err)
		}
		for _, v := range page.Value {
			// You could use page here. We use blank identifier for just demo purposes.
			_ = v
		}
		// If the HTTP response code is 200 as defined in example definition, your page structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
		// page = armsecurity.AlertsSuppressionRulesClientListResponse{
		// 	AlertsSuppressionRulesList: armsecurity.AlertsSuppressionRulesList{
		// 		Value: []*armsecurity.AlertsSuppressionRule{
		// 			{
		// 				Name: to.Ptr("dismissIpAnomalyAlerts"),
		// 				Type: to.Ptr("Microsoft.Security/alertsSuppressionRules"),
		// 				ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissIpAnomalyAlerts"),
		// 				Properties: &armsecurity.AlertsSuppressionRuleProperties{
		// 					AlertType: to.Ptr("IpAnomaly"),
		// 					Comment: to.Ptr("Test VM"),
		// 					ExpirationDateUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-12-01T19:50:47.083633Z"); return t}()),
		// 					LastModifiedUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-07-31T19:50:47.083633Z"); return t}()),
		// 					Reason: to.Ptr("FalsePositive"),
		// 					State: to.Ptr(armsecurity.RuleStateEnabled),
		// 					SuppressionAlertsScope: &armsecurity.SuppressionAlertsScope{
		// 						AllOf: []*armsecurity.ScopeElement{
		// 							{
		// 								Field: to.Ptr("entities.ip.address"),
		// 								AdditionalProperties: map[string]any{
		// 								"in": []any{
		// 									"104.215.95.187",
		// 									"52.164.206.56",
		// 								},
		// 							},
		// 							},
		// 							{
		// 								Field: to.Ptr("entities.process.commandline"),
		// 								AdditionalProperties: map[string]any{
		// 								"contains": "POWERSHELL.EXE",
		// 							},
		// 							},
		// 						},
		// 					},
		// 				},
		// 			},
		// 		},
		// 	},
		// }
	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { SecurityCenter } = require("@azure/arm-security");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to list of all the dismiss rules for the given subscription
 *
 * @summary list of all the dismiss rules for the given subscription
 * x-ms-original-file: 2019-01-01-preview/AlertsSuppressionRules/GetAlertsSuppressionRulesWithAlertType_example.json
 */
async function getSuppressionAlertRuleForSubscriptionFilteredByAlertType() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
  const client = new SecurityCenter(credential, subscriptionId);
  const resArray = new Array();
  for await (const item of client.alertsSuppressionRules.list()) {
    resArray.push(item);
  }

  console.log(resArray);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:

200

{
  "value": [
    {
      "name": "dismissIpAnomalyAlerts",
      "type": "Microsoft.Security/alertsSuppressionRules",
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissIpAnomalyAlerts",
      "properties": {
        "alertType": "IpAnomaly",
        "comment": "Test VM",
        "expirationDateUtc": "2019-12-01T19:50:47.083633Z",
        "lastModifiedUtc": "2019-07-31T19:50:47.083633Z",
        "reason": "FalsePositive",
        "state": "Enabled",
        "suppressionAlertsScope": {
          "allOf": [
            {
              "field": "entities.ip.address",
              "in": [
                "104.215.95.187",
                "52.164.206.56"
              ]
            },
            {
              "contains": "POWERSHELL.EXE",
              "field": "entities.process.commandline"
            }
          ]
        }
      }
    }
  ]
}

Get suppression rules for subscription

Sample request

HTTP

GET https://management.azure.com/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview

Go

package armsecurity_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/security/armsecurity"
)

// Generated from example definition: 2019-01-01-preview/AlertsSuppressionRules/GetAlertsSuppressionRules_example.json
func ExampleAlertsSuppressionRulesClient_NewListPager_getSuppressionRulesForSubscription() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurity.NewClientFactory("20ff7fc3-e762-44dd-bd96-b71116dcdc23", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	pager := clientFactory.NewAlertsSuppressionRulesClient().NewListPager(nil)
	for pager.More() {
		page, err := pager.NextPage(ctx)
		if err != nil {
			log.Fatalf("failed to advance page: %v", err)
		}
		for _, v := range page.Value {
			// You could use page here. We use blank identifier for just demo purposes.
			_ = v
		}
		// If the HTTP response code is 200 as defined in example definition, your page structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
		// page = armsecurity.AlertsSuppressionRulesClientListResponse{
		// 	AlertsSuppressionRulesList: armsecurity.AlertsSuppressionRulesList{
		// 		Value: []*armsecurity.AlertsSuppressionRule{
		// 			{
		// 				Name: to.Ptr("dismissIpAnomalyAlerts"),
		// 				Type: to.Ptr("Microsoft.Security/alertsSuppressionRules"),
		// 				ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissIpAnomalyAlerts"),
		// 				Properties: &armsecurity.AlertsSuppressionRuleProperties{
		// 					AlertType: to.Ptr("IpAnomaly"),
		// 					Comment: to.Ptr("Test VM"),
		// 					ExpirationDateUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-12-01T19:50:47.083633Z"); return t}()),
		// 					LastModifiedUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-07-31T19:50:47.083633Z"); return t}()),
		// 					Reason: to.Ptr("FalsePositive"),
		// 					State: to.Ptr(armsecurity.RuleStateEnabled),
		// 					SuppressionAlertsScope: &armsecurity.SuppressionAlertsScope{
		// 						AllOf: []*armsecurity.ScopeElement{
		// 							{
		// 								Field: to.Ptr("entities.ip.address"),
		// 								AdditionalProperties: map[string]any{
		// 								"in": []any{
		// 									"104.215.95.187",
		// 									"52.164.206.56",
		// 								},
		// 							},
		// 							},
		// 							{
		// 								Field: to.Ptr("entities.process.commandline"),
		// 								AdditionalProperties: map[string]any{
		// 								"contains": "POWERSHELL.EXE",
		// 							},
		// 							},
		// 						},
		// 					},
		// 				},
		// 			},
		// 			{
		// 				Name: to.Ptr("dismissDataExfiltrationAnomalyAlertsOnTestVMs"),
		// 				Type: to.Ptr("Microsoft.Security/alertsSuppressionRules"),
		// 				ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissDataExfiltrationAnomalyAlertsOnTestVMs"),
		// 				Properties: &armsecurity.AlertsSuppressionRuleProperties{
		// 					AlertType: to.Ptr("DataExfiltrationAnomaly"),
		// 					ExpirationDateUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-12-01T19:50:47.083633Z"); return t}()),
		// 					LastModifiedUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-07-31T19:50:47.083633Z"); return t}()),
		// 					Reason: to.Ptr("FalsePositive"),
		// 					State: to.Ptr(armsecurity.RuleStateEnabled),
		// 				},
		// 			},
		// 		},
		// 	},
		// }
	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { SecurityCenter } = require("@azure/arm-security");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to list of all the dismiss rules for the given subscription
 *
 * @summary list of all the dismiss rules for the given subscription
 * x-ms-original-file: 2019-01-01-preview/AlertsSuppressionRules/GetAlertsSuppressionRules_example.json
 */
async function getSuppressionRulesForSubscription() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
  const client = new SecurityCenter(credential, subscriptionId);
  const resArray = new Array();
  for await (const item of client.alertsSuppressionRules.list()) {
    resArray.push(item);
  }

  console.log(resArray);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:

200

{
  "value": [
    {
      "name": "dismissIpAnomalyAlerts",
      "type": "Microsoft.Security/alertsSuppressionRules",
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissIpAnomalyAlerts",
      "properties": {
        "alertType": "IpAnomaly",
        "comment": "Test VM",
        "expirationDateUtc": "2019-12-01T19:50:47.083633Z",
        "lastModifiedUtc": "2019-07-31T19:50:47.083633Z",
        "reason": "FalsePositive",
        "state": "Enabled",
        "suppressionAlertsScope": {
          "allOf": [
            {
              "field": "entities.ip.address",
              "in": [
                "104.215.95.187",
                "52.164.206.56"
              ]
            },
            {
              "contains": "POWERSHELL.EXE",
              "field": "entities.process.commandline"
            }
          ]
        }
      }
    },
    {
      "name": "dismissDataExfiltrationAnomalyAlertsOnTestVMs",
      "type": "Microsoft.Security/alertsSuppressionRules",
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissDataExfiltrationAnomalyAlertsOnTestVMs",
      "properties": {
        "alertType": "DataExfiltrationAnomaly",
        "expirationDateUtc": "2019-12-01T19:50:47.083633Z",
        "lastModifiedUtc": "2019-07-31T19:50:47.083633Z",
        "reason": "FalsePositive",
        "state": "Enabled"
      }
    }
  ]
}

Definitions

Name	Description
AlertsSuppressionRule	Describes the suppression rule
AlertsSuppressionRulesList	Suppression rules list for subscription.
Common.CloudError	Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.).
Common.CloudErrorBody	The error detail.
createdByType	The type of identity that created the resource.
ErrorAdditionalInfo	The resource management error additional info.
RuleState	Possible states of the rule
ScopeElement	A more specific scope used to identify the alerts to suppress.
SuppressionAlertsScope
systemData	Metadata pertaining to creation and last modification of the resource.

AlertsSuppressionRule

Object

Describes the suppression rule

Name	Type	Description
id	string (arm-id)	Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
name	string	The name of the resource
properties.alertType	string	Type of the alert to automatically suppress. For all alert types, use '*'
properties.comment	string	Any comment regarding the rule
properties.expirationDateUtc	string (date-time)	Expiration date of the rule, if value is not provided or provided as null there will no expiration at all
properties.lastModifiedUtc	string (date-time)	The last time this rule was modified
properties.reason	string	The reason for dismissing the alert
properties.state	RuleState	Possible states of the rule
properties.suppressionAlertsScope	SuppressionAlertsScope	The suppression conditions
systemData	systemData	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

AlertsSuppressionRulesList

Object

Suppression rules list for subscription.

Name	Type	Description
nextLink	string (uri)	The link to the next page of items
value	AlertsSuppressionRule[]	The AlertsSuppressionRule items on this page

Common.CloudError

Object

Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.).

Name	Type	Description
error.additionalInfo	ErrorAdditionalInfo[]	The error additional info.
error.code	string	The error code.
error.details	Common.CloudErrorBody[]	The error details.
error.message	string	The error message.
error.target	string	The error target.

Common.CloudErrorBody

Object

The error detail.

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	The error additional info.
code	string	The error code.
details	Common.CloudErrorBody[]	The error details.
message	string	The error message.
target	string	The error target.

createdByType

Enumeration

The type of identity that created the resource.

Value	Description
User
Application
ManagedIdentity
Key

ErrorAdditionalInfo

Object

The resource management error additional info.

Name	Type	Description
info	object	The additional info.
type	string	The additional info type.

RuleState

Enumeration

Possible states of the rule

Value	Description
Enabled	Enabled
Disabled	Disabled
Expired	Expired

ScopeElement

Object

A more specific scope used to identify the alerts to suppress.

Name	Type	Description
field	string	The alert entity type to suppress by.

SuppressionAlertsScope

Object

Name	Type	Description
allOf	ScopeElement[]	All the conditions inside need to be true in order to suppress the alert

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string (date-time)	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string (date-time)	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.