Suppression Rules

Question

Is there a way to automate suppression rules in Defender for Cloud? Or is this operation only done manually in the portal?&nbsp;

stanislavbelov · Answer

Hi&nbsp;tijan2018&nbsp;
&nbsp;
Yes, its possible by using REST APIs:&nbsp;Alerts Suppression Rules - REST API (Azure Security Center) | Microsoft Docs
&nbsp;
Automatically Extend Multiple Suppression Rules on Security Alerts - Microsoft Tech Community

tijan2018 · Answer

Hi Stanislav, thanks so much for your input. I am working with a customer with so many subscriptions with defender for cloud enabled. They are wondering if there is an ARM template available where they can automatically suppress rules across subscriptions instead of having to manually do it on the portal.

stanislavbelov · Answer

I don't think we have anything like this ready to use. Please check out our github repo for all available artifacts: https://github.com/Azure/Microsoft-Defender-for-Cloud

tijan2018 · Answer

Okay thank you. Is there a logic App playbook template available that closes out alerts in Defender for Cloud? I couldn't find anything in GitHub.

Forum Discussion

Suppression Rules

4 Replies