Alerts Suppression Rules - List

Tjänst:

Defender for Cloud

API-version:

2019-01-01-preview

Lista över alla regler för att stänga för den angivna prenumerationen

GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview

Med valfria parametrar:

GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview&AlertType={AlertType}

URI-parametrar

Name	I	Obligatorisk	Typ	Description
subscriptionId	path	True	string	Azure-prenumerations-ID Reguljärt uttrycksmönster: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$
api-version	query	True	string	API-version för åtgärden
AlertType	query		string	Typ av avisering för att hämta regler för

Svar

Name	Typ	Description
200 OK	AlertsSuppressionRulesList	OKEJ
Other Status Codes	CloudError	Felsvar som beskriver varför åtgärden misslyckades.

Säkerhet

azure_auth

Azure Active Directory OAuth2 Flow

Typ: oauth2
Flow: implicit
Auktoriseringswebbadress: https://login.microsoftonline.com/common/oauth2/authorize

Omfattningar

Name	Description
user_impersonation	personifiera ditt användarkonto

Exempel

Get suppression alert rule for subscription, filtered by AlertType

Get suppression rules for subscription

Get suppression alert rule for subscription, filtered by AlertType

Exempelbegäran

HTTP

GET https://management.azure.com/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview

Java

/**
 * Samples for AlertsSuppressionRules List.
 */
public final class Main {
    /*
     * x-ms-original-file:
     * specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/
     * AlertsSuppressionRules/GetAlertsSuppressionRulesWithAlertType_example.json
     */
    /**
     * Sample code: Get suppression alert rule for subscription, filtered by AlertType.
     * 
     * @param manager Entry point to SecurityManager.
     */
    public static void getSuppressionAlertRuleForSubscriptionFilteredByAlertType(
        com.azure.resourcemanager.security.SecurityManager manager) {
        manager.alertsSuppressionRules().list("IpAnomaly", com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Go

package armsecurity_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/security/armsecurity"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/9ac34f238dd6b9071f486b57e9f9f1a0c43ec6f6/specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/AlertsSuppressionRules/GetAlertsSuppressionRulesWithAlertType_example.json
func ExampleAlertsSuppressionRulesClient_NewListPager_getSuppressionAlertRuleForSubscriptionFilteredByAlertType() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurity.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	pager := clientFactory.NewAlertsSuppressionRulesClient().NewListPager(&armsecurity.AlertsSuppressionRulesClientListOptions{AlertType: nil})
	for pager.More() {
		page, err := pager.NextPage(ctx)
		if err != nil {
			log.Fatalf("failed to advance page: %v", err)
		}
		for _, v := range page.Value {
			// You could use page here. We use blank identifier for just demo purposes.
			_ = v
		}
		// If the HTTP response code is 200 as defined in example definition, your page structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
		// page.AlertsSuppressionRulesList = armsecurity.AlertsSuppressionRulesList{
		// 	Value: []*armsecurity.AlertsSuppressionRule{
		// 		{
		// 			Name: to.Ptr("dismissIpAnomalyAlerts"),
		// 			Type: to.Ptr("Microsoft.Security/alertsSuppressionRules"),
		// 			ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissIpAnomalyAlerts"),
		// 			Properties: &armsecurity.AlertsSuppressionRuleProperties{
		// 				AlertType: to.Ptr("IpAnomaly"),
		// 				Comment: to.Ptr("Test VM"),
		// 				ExpirationDateUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-12-01T19:50:47.083Z"); return t}()),
		// 				LastModifiedUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-07-31T19:50:47.083Z"); return t}()),
		// 				Reason: to.Ptr("FalsePositive"),
		// 				State: to.Ptr(armsecurity.RuleStateEnabled),
		// 				SuppressionAlertsScope: &armsecurity.SuppressionAlertsScope{
		// 					AllOf: []*armsecurity.ScopeElement{
		// 						{
		// 							AdditionalProperties: map[string]any{
		// 								"in": []any{
		// 									"104.215.95.187",
		// 									"52.164.206.56",
		// 								},
		// 							},
		// 							Field: to.Ptr("entities.ip.address"),
		// 						},
		// 						{
		// 							AdditionalProperties: map[string]any{
		// 								"contains": "POWERSHELL.EXE",
		// 							},
		// 							Field: to.Ptr("entities.process.commandline"),
		// 					}},
		// 				},
		// 			},
		// 	}},
		// }
	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { SecurityCenter } = require("@azure/arm-security");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to List of all the dismiss rules for the given subscription
 *
 * @summary List of all the dismiss rules for the given subscription
 * x-ms-original-file: specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/AlertsSuppressionRules/GetAlertsSuppressionRulesWithAlertType_example.json
 */
async function getSuppressionAlertRuleForSubscriptionFilteredByAlertType() {
  const subscriptionId =
    process.env["SECURITY_SUBSCRIPTION_ID"] || "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
  const credential = new DefaultAzureCredential();
  const client = new SecurityCenter(credential, subscriptionId);
  const resArray = new Array();
  for await (let item of client.alertsSuppressionRules.list()) {
    resArray.push(item);
  }
  console.log(resArray);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

dotnet

using System;
using System.Threading.Tasks;
using Azure;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.Resources;
using Azure.ResourceManager.SecurityCenter;
using Azure.ResourceManager.SecurityCenter.Models;

// Generated from example definition: specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/AlertsSuppressionRules/GetAlertsSuppressionRulesWithAlertType_example.json
// this example is just showing the usage of "AlertsSuppressionRules_List" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this SubscriptionResource created on azure
// for more information of creating SubscriptionResource, please refer to the document of SubscriptionResource
string subscriptionId = "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
ResourceIdentifier subscriptionResourceId = SubscriptionResource.CreateResourceIdentifier(subscriptionId);
SubscriptionResource subscriptionResource = client.GetSubscriptionResource(subscriptionResourceId);

// get the collection of this SecurityAlertsSuppressionRuleResource
SecurityAlertsSuppressionRuleCollection collection = subscriptionResource.GetSecurityAlertsSuppressionRules();

// invoke the operation and iterate over the result
await foreach (SecurityAlertsSuppressionRuleResource item in collection.GetAllAsync())
{
    // the variable item is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityAlertsSuppressionRuleData resourceData = item.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

Console.WriteLine($"Succeeded");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Exempelsvar

Statuskod:

200

{
  "value": [
    {
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissIpAnomalyAlerts",
      "name": "dismissIpAnomalyAlerts",
      "type": "Microsoft.Security/alertsSuppressionRules",
      "properties": {
        "alertType": "IpAnomaly",
        "lastModifiedUtc": "2019-07-31T19:50:47.083633Z",
        "expirationDateUtc": "2019-12-01T19:50:47.083633Z",
        "state": "Enabled",
        "reason": "FalsePositive",
        "comment": "Test VM",
        "suppressionAlertsScope": {
          "allOf": [
            {
              "field": "entities.ip.address",
              "in": [
                "104.215.95.187",
                "52.164.206.56"
              ]
            },
            {
              "field": "entities.process.commandline",
              "contains": "POWERSHELL.EXE"
            }
          ]
        }
      }
    }
  ]
}

Get suppression rules for subscription

Exempelbegäran

HTTP

GET https://management.azure.com/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview

Java

/**
 * Samples for AlertsSuppressionRules List.
 */
public final class Main {
    /*
     * x-ms-original-file:
     * specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/
     * AlertsSuppressionRules/GetAlertsSuppressionRules_example.json
     */
    /**
     * Sample code: Get suppression rules for subscription.
     * 
     * @param manager Entry point to SecurityManager.
     */
    public static void getSuppressionRulesForSubscription(com.azure.resourcemanager.security.SecurityManager manager) {
        manager.alertsSuppressionRules().list(null, com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Go

package armsecurity_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/security/armsecurity"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/9ac34f238dd6b9071f486b57e9f9f1a0c43ec6f6/specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/AlertsSuppressionRules/GetAlertsSuppressionRules_example.json
func ExampleAlertsSuppressionRulesClient_NewListPager_getSuppressionRulesForSubscription() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurity.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	pager := clientFactory.NewAlertsSuppressionRulesClient().NewListPager(&armsecurity.AlertsSuppressionRulesClientListOptions{AlertType: nil})
	for pager.More() {
		page, err := pager.NextPage(ctx)
		if err != nil {
			log.Fatalf("failed to advance page: %v", err)
		}
		for _, v := range page.Value {
			// You could use page here. We use blank identifier for just demo purposes.
			_ = v
		}
		// If the HTTP response code is 200 as defined in example definition, your page structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
		// page.AlertsSuppressionRulesList = armsecurity.AlertsSuppressionRulesList{
		// 	Value: []*armsecurity.AlertsSuppressionRule{
		// 		{
		// 			Name: to.Ptr("dismissIpAnomalyAlerts"),
		// 			Type: to.Ptr("Microsoft.Security/alertsSuppressionRules"),
		// 			ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissIpAnomalyAlerts"),
		// 			Properties: &armsecurity.AlertsSuppressionRuleProperties{
		// 				AlertType: to.Ptr("IpAnomaly"),
		// 				Comment: to.Ptr("Test VM"),
		// 				ExpirationDateUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-12-01T19:50:47.083Z"); return t}()),
		// 				LastModifiedUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-07-31T19:50:47.083Z"); return t}()),
		// 				Reason: to.Ptr("FalsePositive"),
		// 				State: to.Ptr(armsecurity.RuleStateEnabled),
		// 				SuppressionAlertsScope: &armsecurity.SuppressionAlertsScope{
		// 					AllOf: []*armsecurity.ScopeElement{
		// 						{
		// 							AdditionalProperties: map[string]any{
		// 								"in": []any{
		// 									"104.215.95.187",
		// 									"52.164.206.56",
		// 								},
		// 							},
		// 							Field: to.Ptr("entities.ip.address"),
		// 						},
		// 						{
		// 							AdditionalProperties: map[string]any{
		// 								"contains": "POWERSHELL.EXE",
		// 							},
		// 							Field: to.Ptr("entities.process.commandline"),
		// 					}},
		// 				},
		// 			},
		// 		},
		// 		{
		// 			Name: to.Ptr("dismissDataExfiltrationAnomalyAlertsOnTestVMs"),
		// 			Type: to.Ptr("Microsoft.Security/alertsSuppressionRules"),
		// 			ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissDataExfiltrationAnomalyAlertsOnTestVMs"),
		// 			Properties: &armsecurity.AlertsSuppressionRuleProperties{
		// 				AlertType: to.Ptr("DataExfiltrationAnomaly"),
		// 				ExpirationDateUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-12-01T19:50:47.083Z"); return t}()),
		// 				LastModifiedUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-07-31T19:50:47.083Z"); return t}()),
		// 				Reason: to.Ptr("FalsePositive"),
		// 				State: to.Ptr(armsecurity.RuleStateEnabled),
		// 			},
		// 	}},
		// }
	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { SecurityCenter } = require("@azure/arm-security");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to List of all the dismiss rules for the given subscription
 *
 * @summary List of all the dismiss rules for the given subscription
 * x-ms-original-file: specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/AlertsSuppressionRules/GetAlertsSuppressionRules_example.json
 */
async function getSuppressionRulesForSubscription() {
  const subscriptionId =
    process.env["SECURITY_SUBSCRIPTION_ID"] || "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
  const credential = new DefaultAzureCredential();
  const client = new SecurityCenter(credential, subscriptionId);
  const resArray = new Array();
  for await (let item of client.alertsSuppressionRules.list()) {
    resArray.push(item);
  }
  console.log(resArray);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

dotnet

using System;
using System.Threading.Tasks;
using Azure;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.Resources;
using Azure.ResourceManager.SecurityCenter;
using Azure.ResourceManager.SecurityCenter.Models;

// Generated from example definition: specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/AlertsSuppressionRules/GetAlertsSuppressionRules_example.json
// this example is just showing the usage of "AlertsSuppressionRules_List" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this SubscriptionResource created on azure
// for more information of creating SubscriptionResource, please refer to the document of SubscriptionResource
string subscriptionId = "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
ResourceIdentifier subscriptionResourceId = SubscriptionResource.CreateResourceIdentifier(subscriptionId);
SubscriptionResource subscriptionResource = client.GetSubscriptionResource(subscriptionResourceId);

// get the collection of this SecurityAlertsSuppressionRuleResource
SecurityAlertsSuppressionRuleCollection collection = subscriptionResource.GetSecurityAlertsSuppressionRules();

// invoke the operation and iterate over the result
await foreach (SecurityAlertsSuppressionRuleResource item in collection.GetAllAsync())
{
    // the variable item is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityAlertsSuppressionRuleData resourceData = item.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

Console.WriteLine($"Succeeded");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Exempelsvar

Statuskod:

200

{
  "value": [
    {
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissIpAnomalyAlerts",
      "name": "dismissIpAnomalyAlerts",
      "type": "Microsoft.Security/alertsSuppressionRules",
      "properties": {
        "alertType": "IpAnomaly",
        "lastModifiedUtc": "2019-07-31T19:50:47.083633Z",
        "expirationDateUtc": "2019-12-01T19:50:47.083633Z",
        "state": "Enabled",
        "reason": "FalsePositive",
        "comment": "Test VM",
        "suppressionAlertsScope": {
          "allOf": [
            {
              "field": "entities.ip.address",
              "in": [
                "104.215.95.187",
                "52.164.206.56"
              ]
            },
            {
              "field": "entities.process.commandline",
              "contains": "POWERSHELL.EXE"
            }
          ]
        }
      }
    },
    {
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissDataExfiltrationAnomalyAlertsOnTestVMs",
      "name": "dismissDataExfiltrationAnomalyAlertsOnTestVMs",
      "type": "Microsoft.Security/alertsSuppressionRules",
      "properties": {
        "alertType": "DataExfiltrationAnomaly",
        "lastModifiedUtc": "2019-07-31T19:50:47.083633Z",
        "expirationDateUtc": "2019-12-01T19:50:47.083633Z",
        "state": "Enabled",
        "reason": "FalsePositive"
      }
    }
  ]
}

Definitioner

Name	Description
AlertsSuppressionRule	Beskriver undertryckningsregeln
AlertsSuppressionRulesList	Lista över regler för undertryckning för prenumeration.
CloudError	Vanligt felsvar för alla Azure Resource Manager-API:er för att returnera felinformation för misslyckade åtgärder. (Detta följer även formatet för OData-felsvar.).
CloudErrorBody	Felinformationen.
ErrorAdditionalInfo	Ytterligare information om resurshanteringsfelet.
RuleState	Möjliga tillstånd för regeln
ScopeElement	Ett mer specifikt omfång som används för att identifiera aviseringarna som ska ignoreras.
SuppressionAlertsScope

AlertsSuppressionRule

Beskriver undertryckningsregeln

Name	Typ	Description
id	string	Resurs-ID
name	string	Resursnamn
properties.alertType	string	Typ av avisering som ska ignoreras automatiskt. Använd *för alla aviseringstyper
properties.comment	string	Eventuella kommentarer om regeln
properties.expirationDateUtc	string	Förfallodatum för regeln, om värdet inte anges eller anges som null kommer det inte att upphöra att gälla alls
properties.lastModifiedUtc	string	Senaste gången den här regeln ändrades
properties.reason	string	Anledningen till att avvisa aviseringen
properties.state	RuleState	Möjliga tillstånd för regeln
properties.suppressionAlertsScope	SuppressionAlertsScope	Undertryckningsvillkoren
type	string	Resurstyp

AlertsSuppressionRulesList

Lista över regler för undertryckning för prenumeration.

Name	Typ	Description
nextLink	string	URI för att hämta nästa sida.
value	AlertsSuppressionRule[]	Beskriver undertryckningsregeln

CloudError

Vanligt felsvar för alla Azure Resource Manager-API:er för att returnera felinformation för misslyckade åtgärder. (Detta följer även formatet för OData-felsvar.).

Name	Typ	Description
error.additionalInfo	ErrorAdditionalInfo[]	Ytterligare information om felet.
error.code	string	Felkoden.
error.details	CloudErrorBody[]	Felinformationen.
error.message	string	Felmeddelandet.
error.target	string	Felmålet.

CloudErrorBody

Felinformationen.

Name	Typ	Description
additionalInfo	ErrorAdditionalInfo[]	Ytterligare information om felet.
code	string	Felkoden.
details	CloudErrorBody[]	Felinformationen.
message	string	Felmeddelandet.
target	string	Felmålet.

ErrorAdditionalInfo

Ytterligare information om resurshanteringsfelet.

Name	Typ	Description
info	object	Ytterligare information.
type	string	Ytterligare informationstyp.

RuleState

Möjliga tillstånd för regeln

Name	Typ	Description
Disabled	string
Enabled	string
Expired	string

ScopeElement

Ett mer specifikt omfång som används för att identifiera aviseringarna som ska ignoreras.

Name	Typ	Description
field	string	Den aviseringsentitetstyp som ska ignoreras av.

SuppressionAlertsScope

Name	Typ	Description
allOf	ScopeElement[]	Alla villkor inuti måste vara sanna för att förhindra aviseringen