azure-defender-suppress-alerts
Create or modify a Defender for Cloud alert suppression rule (Microsoft.Security/ alertsSuppressionRules/write); suppressed alert types are auto-dismissed before analysts see them, reducing SOC visibility into the suppressed attack patterns.
match (effective permission)
{
"action": "Microsoft.Security/alertsSuppressionRules/write",
"scope_type": "subscription"
}
where
principal effectively holds Security Admin, Contributor, Owner, or a custom role granting Microsoft.Security/alertsSuppressionRules/write at subscription scope
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | <principal> |
| target | <Defender alert suppression rule node (SecurityService) in the subscription> |
| permissions | Microsoft.Security/alertsSuppressionRules/write |
| state logic | ACTIVE when the effective permission is confirmed at subscription scope. BLOCKED if a deny assignment covers alertsSuppressionRules/write at effective scope. NOTE: Suppression rules mute SPECIFIC alert types or resource-scoped alerts — narrower blast radius than pricings/write (plan disablement), but more surgical (targets only alert patterns relevant to the attacker's TTPs). This is a DETECTIVE-CONTROL tampering edge; it does not affect access controls or set BLOCKED on any resource-access edge. |
Narrative
{principal.name} can create or modify alert suppression rules in subscription {target.name} (Microsoft.Security/alertsSuppressionRules/write). A suppression rule auto-dismisses all Defender alerts matching the specified alert type and optional resource/entity scope before analysts see them in the Security Center portal or receive notifications - enabling an attacker to selectively mute alerts for their TTPs while leaving other alerting intact.
Raw rule rules/derived/azure/defender.yaml
id: azure-defender-suppress-alerts
emits: CanModify
description: Create or modify a Defender for Cloud alert suppression rule (Microsoft.Security/ alertsSuppressionRules/write);
suppressed alert types are auto-dismissed before analysts see them, reducing SOC visibility into the
suppressed attack patterns.
match_effective_permission:
action: Microsoft.Security/alertsSuppressionRules/write
scope_type: subscription
where:
- principal effectively holds Security Admin, Contributor, Owner, or a custom role granting Microsoft.Security/alertsSuppressionRules/write
at subscription scope
emit:
source_type: Identity
target_type: SecurityService
source: <principal>
target: <Defender alert suppression rule node (SecurityService) in the subscription>
permissions:
- Microsoft.Security/alertsSuppressionRules/write
conditions: []
state_logic: "ACTIVE when the effective permission is confirmed at subscription scope. BLOCKED if a\
\ deny assignment covers alertsSuppressionRules/write at effective scope. NOTE: Suppression rules\
\ mute SPECIFIC alert types or resource-scoped alerts \u2014 narrower blast radius than pricings/write\
\ (plan disablement), but more surgical (targets only alert patterns relevant to the attacker's TTPs).\
\ This is a DETECTIVE-CONTROL tampering edge; it does not affect access controls or set BLOCKED on\
\ any resource-access edge."
confidence: 0.95
derived_from:
- HasPermission(Identity, SecurityService:alertsSuppressionRules, Microsoft.Security/alertsSuppressionRules/write)
false_positive_note: "alertsSuppressionRules/write allows creation of rules that auto-dismiss Defender\
\ alerts matching a specified alert type, entity (resource, IP, user), and optional reason. Suppression\
\ rules have a configurable expiry date; a rule set to a far-future expiry is persistent suppression.\
\ The write action also covers modification of existing rules (widening scope or extending expiry)\
\ and creation of new rules for previously-unmatched alert types. Narrower than plan disablement (pricings/write):\
\ suppression only silences the matched alert patterns, not all detection for a resource type. Do\
\ NOT chain to privilege escalation \u2014 this is evasion, not access."
narrative: "{principal.name} can create or modify alert suppression rules in subscription {target.name}\
\ (Microsoft.Security/alertsSuppressionRules/write). A suppression rule auto-dismisses all Defender\
\ alerts matching the specified alert type and optional resource/entity scope before analysts see\
\ them in the Security Center portal or receive notifications \u2014 enabling an attacker to selectively\
\ mute alerts for their TTPs while leaving other alerting intact."