Suppression Rules

[tijan2018]

Is there a way to automate suppression rules in Defender for Cloud? Or is this operation only done manually in the portal? 

[#2]

Hi @tijan2018 

Yes, its possible by using REST APIs: Alerts Suppression Rules - REST API (Azure Security Center) | Microsoft Docs

Automatically Extend Multiple Suppression Rules on Security Alerts - Microsoft Tech Community

[#3]

Hi Stanislav, thanks so much for your input. I am working with a customer with so many subscriptions with defender for cloud enabled. They are wondering if there is an ARM template available where they can automatically suppress rules across subscriptions instead of having to manually do it on the portal.

[#4]

I don't think we have anything like this ready to use. Please check out our github repo for all available artifacts: https://github.com/Azure/Microsoft-Defender-for-Cloud

[#5]

Okay thank you. Is there a logic App playbook template available that closes out alerts in Defender for Cloud? I couldn't find anything in GitHub.