Microsoft.Security alertsSuppressionRules

• Latest
• 2019-01-01-preview

Bicep resource definition

The alertsSuppressionRules resource type can be deployed with operations that target:

• Subscriptions - See subscription deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Security/alertsSuppressionRules resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Security/alertsSuppressionRules@2019-01-01-preview' = {
  name: 'string'
  properties: {
    alertType: 'string'
    comment: 'string'
    expirationDateUtc: 'string'
    reason: 'string'
    state: 'string'
    suppressionAlertsScope: {
      allOf: [
        {
          field: 'string'
          {customized property}: any()
        }
      ]
    }
  }
}

Property values

alertsSuppressionRules

Name	Description	Value
name	The resource name	string (required) Character limit: 1-260 Valid characters: Alphanumerics, underscores, and hyphens.
properties	describes AlertsSuppressionRule properties	AlertsSuppressionRuleProperties

AlertsSuppressionRuleProperties

Name	Description	Value
alertType	Type of the alert to automatically suppress. For all alert types, use '*'	string (required)
comment	Any comment regarding the rule	string
expirationDateUtc	Expiration date of the rule, if value is not provided or provided as null there will no expiration at all	string
reason	The reason for dismissing the alert	string (required)
state	Possible states of the rule	'Disabled' 'Enabled' 'Expired' (required)
suppressionAlertsScope	The suppression conditions	SuppressionAlertsScope

SuppressionAlertsScope

Name	Description	Value
allOf	All the conditions inside need to be true in order to suppress the alert	ScopeElement[] (required)

ScopeElement

Name	Description	Value
field	The alert entity type to suppress by.	string
{customized property}		For Bicep, you can use the any() function.

ARM template resource definition

The alertsSuppressionRules resource type can be deployed with operations that target:

• Subscriptions - See subscription deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Security/alertsSuppressionRules resource, add the following JSON to your template.

{
  "type": "Microsoft.Security/alertsSuppressionRules",
  "apiVersion": "2019-01-01-preview",
  "name": "string",
  "properties": {
    "alertType": "string",
    "comment": "string",
    "expirationDateUtc": "string",
    "reason": "string",
    "state": "string",
    "suppressionAlertsScope": {
      "allOf": [
        {
          "field": "string",
          "{customized property}": {}
        }
      ]
    }
  }
}

Property values

alertsSuppressionRules

Name	Description	Value
type	The resource type	'Microsoft.Security/alertsSuppressionRules'
apiVersion	The resource api version	'2019-01-01-preview'
name	The resource name	string (required) Character limit: 1-260 Valid characters: Alphanumerics, underscores, and hyphens.
properties	describes AlertsSuppressionRule properties	AlertsSuppressionRuleProperties

AlertsSuppressionRuleProperties

Name	Description	Value
alertType	Type of the alert to automatically suppress. For all alert types, use '*'	string (required)
comment	Any comment regarding the rule	string
expirationDateUtc	Expiration date of the rule, if value is not provided or provided as null there will no expiration at all	string
reason	The reason for dismissing the alert	string (required)
state	Possible states of the rule	'Disabled' 'Enabled' 'Expired' (required)
suppressionAlertsScope	The suppression conditions	SuppressionAlertsScope

SuppressionAlertsScope

Name	Description	Value
allOf	All the conditions inside need to be true in order to suppress the alert	ScopeElement[] (required)

ScopeElement

Name	Description	Value
field	The alert entity type to suppress by.	string
{customized property}

Terraform (AzAPI provider) resource definition

The alertsSuppressionRules resource type can be deployed with operations that target:

• Subscriptions

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Security/alertsSuppressionRules resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Security/alertsSuppressionRules@2019-01-01-preview"
  name = "string"
  parent_id = "string"
  body = jsonencode({
    properties = {
      alertType = "string"
      comment = "string"
      expirationDateUtc = "string"
      reason = "string"
      state = "string"
      suppressionAlertsScope = {
        allOf = [
          {
            field = "string"
          }
        ]
      }
    }
  })
}

Property values

alertsSuppressionRules

Name	Description	Value
type	The resource type	"Microsoft.Security/alertsSuppressionRules@2019-01-01-preview"
name	The resource name	string (required) Character limit: 1-260 Valid characters: Alphanumerics, underscores, and hyphens.
parent_id	To deploy to a subscription, use the ID of that subscription.	string (required)
properties	describes AlertsSuppressionRule properties	AlertsSuppressionRuleProperties

AlertsSuppressionRuleProperties

Name	Description	Value
alertType	Type of the alert to automatically suppress. For all alert types, use '*'	string (required)
comment	Any comment regarding the rule	string
expirationDateUtc	Expiration date of the rule, if value is not provided or provided as null there will no expiration at all	string
reason	The reason for dismissing the alert	string (required)
state	Possible states of the rule	"Disabled" "Enabled" "Expired" (required)
suppressionAlertsScope	The suppression conditions	SuppressionAlertsScope

SuppressionAlertsScope

Name	Description	Value
allOf	All the conditions inside need to be true in order to suppress the alert	ScopeElement[] (required)

ScopeElement

Name	Description	Value
field	The alert entity type to suppress by.	string
{customized property}