Share via

az security alerts-suppression-rule

View and manage alerts suppression rules.

Commands

Name Description Type Status
az security alerts-suppression-rule delete

Delete an alerts suppression rule.

 Core GA
az security alerts-suppression-rule delete_scope

Delete an alerts suppression rule scope.

 Core GA
az security alerts-suppression-rule list

List all alerts suppression rule on a subscription scope.

 Core GA
az security alerts-suppression-rule show

Shows an alerts suppression rule.

 Core GA
az security alerts-suppression-rule update

Updates or create an alerts suppression rule.

 Core GA
az security alerts-suppression-rule upsert_scope

Update an alerts suppression rule with scope element.

 Core GA

az security alerts-suppression-rule delete

Edit

Delete an alerts suppression rule.

az security alerts-suppression-rule delete --rule-name

Examples

Delete an alerts suppression rule.

az security alerts-suppression-rule delete --rule-name RuleName

Required Parameters

--rule-name

The unique name of the alerts suppression rule.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az security alerts-suppression-rule delete_scope

Edit

Delete an alerts suppression rule scope.

az security alerts-suppression-rule delete_scope --field
                                                 --rule-name

Examples

Delete an alerts suppression rule scope.

az security alerts-suppression-rule delete_scope --rule-name RuleName --field "entities.process.commandline"

Required Parameters

--field

Entity name.

--rule-name

The unique name of the alerts suppression rule.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az security alerts-suppression-rule list

Edit

List all alerts suppression rule on a subscription scope.

az security alerts-suppression-rule list

Examples

List alerts suppression rules.

az security alerts-suppression-rule list
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az security alerts-suppression-rule show

Edit

Shows an alerts suppression rule.

az security alerts-suppression-rule show --rule-name

Examples

Get an alerts suppression rule on a subscription scope.

az security alerts-suppression-rule show --rule-name RuleName

Required Parameters

--rule-name

The unique name of the alerts suppression rule.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az security alerts-suppression-rule update

Edit

Updates or create an alerts suppression rule.

az security alerts-suppression-rule update --alert-type
                                           --reason
                                           --rule-name
                                           --state
                                           [--comment]
                                           [--expiration-date-utc]

Examples

Create suppression rule with entities.

az security alerts-suppression-rule update --rule-name RuleName --alert-type "Test" --reason "Other" --comment "Test comment" --state "Enabled"

Required Parameters

--alert-type

Type of the alert to automatically suppress. For all alert types, use "*".

--reason

The reason for dismissing the alert.

--rule-name

The unique name of the alerts suppression rule.

--state

Possible states of the rule. Possible values are "Enabled" and "Disabled".

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--comment

Any comment regarding the rule.

--expiration-date-utc

Expiration date of the rule, if value is not provided or provided as null this field will default to the maximum allowed expiration date.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az security alerts-suppression-rule upsert_scope

Edit

Update an alerts suppression rule with scope element.

az security alerts-suppression-rule upsert_scope --field
                                                 --rule-name
                                                 [--any-of]
                                                 [--contains-substring]

Examples

Add "entities.host.dnsdomain" scope to an alerts suppression rule.

az security alerts-suppression-rule upsert_scope --field "entities.process.commandline" --contains-substring "example" --rule-name RuleName

Required Parameters

--field

Entity name.

--rule-name

The unique name of the alerts suppression rule.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--any-of

A list of strings to scope the suppression rule by.

--contains-substring

The string to scope the suppression rule by.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False