Microsoft Sentinel - Alert suppression

Suppressing alerts in Microsoft Sentinel efficiently and flexibly—especially when dealing with combinations of UPNs, IPs, hostnames, and wildcard logic—is a common but tricky challenge due to limitations in wildcards, dynamic matching, and maintainability.

Here’s a breakdown of the most practical approaches—their pros, cons, and a recommended hybrid strategy.

Best Practice Recommendation (Hybrid Model)

Use a structured Watchlist with parameterized KQL filtering, combined with smart matching (regex or dynamic logic).

Step-by-Step Approach

1.Use a Sentinel Watchlist with Structured Schema

Example schema:

json

CopyEdit

[

  { "UPN": "email address removed for privacy reasons", "IP": "10.10.1.1", "Hostname": "host01" },

  { "UPN": "*", "IP": "10.10.1.1", "Hostname": "*" },

  { "UPN": "email address removed for privacy reasons", "IP": "*", "Hostname": "*" }

]

Represent * explicitly as a string for wildcard logic.

2.Use KQL with Flexible Matching

Since Watchlist does not support * natively, use dynamic joins or conditionals:

kql

CopyEdit

let suppressionList =

    (_GetWatchlist('SuppressedAlerts')

    | project UPN, IP, Hostname);

SecurityAlert

| extend AlertUPN = tostring(parse_json(Entities)[0].UPN),  // Customize based on your alert schema

         AlertIP = tostring(parse_json(Entities)[0].Address),

         AlertHost = tostring(parse_json(Entities)[0].HostName)

| join kind=leftouter suppressionList

    on $left.AlertUPN == $right.UPN or $right.UPN == "*"

       and $left.AlertIP == $right.IP or $right.IP == "*"

       and $left.AlertHost == $right.Hostname or $right.Hostname == "*"

| where isnull(UPN)  // Only keep alerts that did not match suppression

You can customize this logic further to handle partial wildcards (e.g., regex match).

3.Advanced Matching with Regex (Optional)

If you want partial wildcards (e.g., domain match, subnet IP), preprocess Watchlist into a dynamic table with parse_json() and do:

kql

CopyEdit

| where AlertUPN matches regex WatchlistRegex

But note that regex matching in joins is more compute-intensive, so use with caution on large datasets.

What to Avoid

Hardcoding in KQL

• Not scalable
• Requires pipeline deployment to update
• Breaks SDLC separation

Automation Rules Alone

• Great for entity-level logic (e.g., user, host), but lacks fine-grained matching across multiple fields or wildcarding.