alerts_suppression_rules

Creates, updates, deletes, gets or lists an alerts_suppression_rules resource.

Overview

Name	alerts_suppression_rules
Type	Resource
Id	azure.security.alerts_suppression_rules

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
alertType	string	Type of the alert to automatically suppress. For all alert types, use '*'. Required.
comment	string	Any comment regarding the rule.
expirationDateUtc	string (date-time)	Expiration date of the rule, if value is not provided or provided as null there will no expiration at all.
lastModifiedUtc	string (date-time)	The last time this rule was modified.
reason	string	The reason for dismissing the alert. Required.
state	string	Possible states of the rule. Required. Known values are: "Enabled", "Disabled", and "Expired". (Enabled, Disabled, Expired)
suppressionAlertsScope	object	The suppression conditions.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
alertType	string	Type of the alert to automatically suppress. For all alert types, use '*'. Required.
comment	string	Any comment regarding the rule.
expirationDateUtc	string (date-time)	Expiration date of the rule, if value is not provided or provided as null there will no expiration at all.
lastModifiedUtc	string (date-time)	The last time this rule was modified.
reason	string	The reason for dismissing the alert. Required.
state	string	Possible states of the rule. Required. Known values are: "Enabled", "Disabled", and "Expired". (Enabled, Disabled, Expired)
suppressionAlertsScope	object	The suppression conditions.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	alerts_suppression_rule_name, subscription_id		Get dismiss rule, with name: {alertsSuppressionRuleName}, for the given subscription.
list	select	subscription_id	AlertType	List of all the dismiss rules for the given subscription.
update	update	alerts_suppression_rule_name, subscription_id		Update existing rule or create new rule if it doesn't exist.
delete	delete	alerts_suppression_rule_name, subscription_id		Delete dismiss alert rule for this subscription.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
alerts_suppression_rule_name	string	The unique name of the suppression alert rule. Required.
subscription_id	string
AlertType	string	Type of the alert to get rules for. Default value is None.

SELECT examples

get

Get dismiss rule, with name: {alertsSuppressionRuleName}, for the given subscription.

SELECT
id,
name,
alertType,
comment,
expirationDateUtc,
lastModifiedUtc,
reason,
state,
suppressionAlertsScope,
systemData,
type
FROM azure.security.alerts_suppression_rules
WHERE alerts_suppression_rule_name = '{{ alerts_suppression_rule_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

List of all the dismiss rules for the given subscription.

SELECT
id,
name,
alertType,
comment,
expirationDateUtc,
lastModifiedUtc,
reason,
state,
suppressionAlertsScope,
systemData,
type
FROM azure.security.alerts_suppression_rules
WHERE subscription_id = '{{ subscription_id }}' -- required
AND AlertType = '{{ AlertType }}'
;

UPDATE examples

update

Update existing rule or create new rule if it doesn't exist.

UPDATE azure.security.alerts_suppression_rules
SET 
properties = '{{ properties }}'
WHERE 
alerts_suppression_rule_name = '{{ alerts_suppression_rule_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
properties,
systemData,
type;

DELETE examples

delete

Delete dismiss alert rule for this subscription.

DELETE FROM azure.security.alerts_suppression_rules
WHERE alerts_suppression_rule_name = '{{ alerts_suppression_rule_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;