Set-AzAlertsSuppressionRule

Reference

Module:: Az.Security

Create or update an alerts suppression rule.

Syntax

Set-AzAlertsSuppressionRule
   -Name <String>
   -AlertType <String>
   [-ExpirationDateUtc <DateTime>]
   -Reason <String>
   -State <PSRuleState>
   [-Comment <String>]
   [-SuppressionAlertsScope <PSSuppressionAlertsScope>]
   [-AllOf <PSIScopeElement[]>]
   [-DefaultProfile <IAzureContextContainer>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Set-AzAlertsSuppressionRule
   -InputObject <PSAlertsSuppressionRule>
   [-Name <String>]
   [-AlertType <String>]
   [-ExpirationDateUtc <DateTime>]
   [-Reason <String>]
   [-State <PSRuleState>]
   [-Comment <String>]
   [-SuppressionAlertsScope <PSSuppressionAlertsScope>]
   [-AllOf <PSIScopeElement[]>]
   [-DefaultProfile <IAzureContextContainer>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Description

Create or update an alerts suppression rule.

Examples

Example 1

Set-AzAlertsSuppressionRule -Name "Example" -State Enabled -Comment "Example of a comment" -AlertType "AzureDNS_CurrencyMining" -Reason "Other" -AllOf @([Microsoft.Azure.Commands.Security.Models.AlertsSuppressionRules.PSScopeElementContains]::new("entities.account.name", "example")) -ExpirationDateUtc 2024-10-17T15:02:24.7511441Z

The above example creates a new suppression rule with the name "Example" to suppress alerts of type (Digital currency mining activity)[https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference] that contains "example" as part of their account name.

Parameters

-AlertType

Alert type to suppress.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-AllOf

Scope the suppression rule using specific entities.

Type:	PSIScopeElement[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Comment

Comment.

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type:	SwitchParameter
Aliases:	cf
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-DefaultProfile

The credentials, account, tenant, and subscription used for communication with Azure.

Type:	IAzureContextContainer
Aliases:	AzContext, AzureRmContext, AzureCredential
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ExpirationDateUtc

Set an expiration data for the rule, expected to be in a UTC format.

Type:	Nullable<T>[DateTime]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-InputObject

Input Object.

Type:	PSAlertsSuppressionRule
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-Name

Alert suppression rule name, needs to be unique per subscription.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-Reason

The reason for creating the suppression rule.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-State

State of the rule, Enabled/Disabled

Type:	PSRuleState
Accepted values:	Enabled, Disabled, Expired, Enabled, Disabled, Expired
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-SuppressionAlertsScope