Skip to main content

alerts

Creates, updates, deletes, gets or lists an alerts resource.

Overview​

Namealerts
TypeResource
Idazure.security.alerts

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
idstringFully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
namestringThe name of the resource.
alertDisplayNamestringThe display name of the alert.
alertTypestringUnique identifier for the detection logic (all alert instances from the same detection logic will have the same alertType).
alertUristringA direct link to the alert page in Azure Portal.
compromisedEntitystringThe display name of the resource most related to this alert.
correlationKeystringKey for corelating related alerts. Alerts with the same correlation key considered to be related.
descriptionstringDescription of the suspicious activity that was detected.
endTimeUtcstring (date-time)The UTC time of the last event or activity included in the alert in ISO8601 format.
entitiesarrayA list of entities related to the alert.
extendedLinksarrayLinks related to the alert.
extendedPropertiesobjectCustom properties for the alert.
intentstringThe kill chain related intent behind the alert. For list of supported values, and explanations of Azure Security Center's supported kill chain intents. Known values are: "Unknown", "PreAttack", "InitialAccess", "Persistence", "PrivilegeEscalation", "DefenseEvasion", "CredentialAccess", "Discovery", "LateralMovement", "Execution", "Collection", "Exfiltration", "CommandAndControl", "Impact", "Probing", and "Exploitation". (Unknown, PreAttack, InitialAccess, Persistence, PrivilegeEscalation, DefenseEvasion, CredentialAccess, Discovery, LateralMovement, Execution, Collection, Exfiltration, CommandAndControl, Impact, Probing, Exploitation)
isIncidentbooleanThis field determines whether the alert is an incident (a compound grouping of several alerts) or a single alert.
processingEndTimeUtcstring (date-time)The UTC processing end time of the alert in ISO8601 format.
productComponentNamestringThe name of Azure Security Center pricing tier which powering this alert. Learn more: https://docs.microsoft.com/en-us/azure/security-center/security-center-pricing _.
productNamestringThe name of the product which published this alert (Microsoft Sentinel, Microsoft Defender for Identity, Microsoft Defender for Endpoint, Microsoft Defender for Office, Microsoft Defender for Cloud Apps, and so on).
remediationStepsarrayManual action items to take to remediate the alert.
resourceIdentifiersarrayThe resource identifiers that can be used to direct the alert to the right product exposure group (tenant, workspace, subscription etc.). There can be multiple identifiers of different type per alert.
severitystringThe risk level of the threat that was detected. Learn more: https://docs.microsoft.com/en-us/azure/security-center/security-center-alerts-overview#how-are-alerts-classified _. Known values are: "Informational", "Low", "Medium", and "High". (Informational, Low, Medium, High)
startTimeUtcstring (date-time)The UTC time of the first event or activity included in the alert in ISO8601 format.
statusstringThe life cycle status of the alert. Known values are: "Active", "InProgress", "Resolved", and "Dismissed". (Active, InProgress, Resolved, Dismissed)
subTechniquesarrayKill chain related sub-techniques behind the alert.
supportingEvidenceobjectChanging set of properties depending on the supportingEvidence type.
systemAlertIdstringUnique identifier for the alert.
systemDataobjectAzure Resource Manager metadata containing createdBy and modifiedBy information.
techniquesarraykill chain related techniques behind the alert.
timeGeneratedUtcstring (date-time)The UTC time the alert was generated in ISO8601 format.
typestringThe type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
vendorNamestringThe name of the vendor that raises the alert.
versionstringSchema version.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
get_resource_group_levelselectresource_group_name, asc_location, alert_name, subscription_idGet an alert that is associated a resource group or a resource in a resource group.
list_resource_group_level_by_regionselectasc_location, resource_group_name, subscription_idList all the alerts that are associated with the resource group that are stored in a specific location.
get_subscription_levelselectasc_location, alert_name, subscription_idGet an alert that is associated with a subscription.
list_by_resource_groupselectresource_group_name, subscription_idList all the alerts that are associated with the resource group.
list_subscription_level_by_regionselectasc_location, subscription_idList all the alerts that are associated with the subscription that are stored in a specific location.
listselectsubscription_idList all the alerts that are associated with the subscription.
update_subscription_level_state_to_dismissexecasc_location, alert_name, subscription_idUpdate the alert's state.
update_subscription_level_state_to_resolveexecasc_location, alert_name, subscription_idUpdate the alert's state.
update_subscription_level_state_to_activateexecasc_location, alert_name, subscription_idUpdate the alert's state.
update_subscription_level_state_to_in_progressexecasc_location, alert_name, subscription_idUpdate the alert's state.
update_resource_group_level_state_to_resolveexecresource_group_name, asc_location, alert_name, subscription_idUpdate the alert's state.
update_resource_group_level_state_to_dismissexecresource_group_name, asc_location, alert_name, subscription_idUpdate the alert's state.
update_resource_group_level_state_to_activateexecresource_group_name, asc_location, alert_name, subscription_idUpdate the alert's state.
update_resource_group_level_state_to_in_progressexecresource_group_name, asc_location, alert_name, subscription_idUpdate the alert's state.
simulateexecasc_location, subscription_idSimulate security alerts.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
alert_namestringName of the alert object. Required.
asc_locationstringThe location where ASC stores the data of the subscription. can be retrieved from Get locations. Required.
resource_group_namestringThe name of the resource group. The name is case insensitive. Required.
subscription_idstring

SELECT examples​

Get an alert that is associated a resource group or a resource in a resource group.

SELECT
id,
name,
alertDisplayName,
alertType,
alertUri,
compromisedEntity,
correlationKey,
description,
endTimeUtc,
entities,
extendedLinks,
extendedProperties,
intent,
isIncident,
processingEndTimeUtc,
productComponentName,
productName,
remediationSteps,
resourceIdentifiers,
severity,
startTimeUtc,
status,
subTechniques,
supportingEvidence,
systemAlertId,
systemData,
techniques,
timeGeneratedUtc,
type,
vendorName,
version
FROM azure.security.alerts
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND asc_location = '{{ asc_location }}' -- required
AND alert_name = '{{ alert_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

Lifecycle Methods​

Update the alert's state.

EXEC azure.security.alerts.update_subscription_level_state_to_dismiss 
@asc_location='{{ asc_location }}' --required, 
@alert_name='{{ alert_name }}' --required, 
@subscription_id='{{ subscription_id }}' --required
;