跳到主要内容

Manage Alert Suppression Rules

Implementation Effort: Medium — Requires security teams to define suppression criteria, configure rules via the portal or API, and periodically review suppressed alerts.

User Impact: Low — Alert suppression is a backend configuration; users are not directly affected.

Overview​

Managing alert suppression rules in Microsoft Defender for Storage (via Defender for Cloud) helps reduce alert fatigue by hiding known, non-actionable alerts. This allows security teams to focus on high-priority threats while maintaining visibility into critical storage-related incidents.

Key Capabilities​

  • Suppress Known Benign Alerts: Suppress alerts triggered by expected or approved activity (e.g., known scanning tools or automation scripts).
  • Custom Rule Creation: Define suppression rules based on alert type, resource, or other metadata.
  • API Support: Use the Defender for Cloud REST API to create, view, or delete suppression rules programmatically 1.
  • Rule Management: View, edit, enable/disable, or delete suppression rules from the Defender portal 1.

How to Manage Suppression Rules​

  1. Via Azure Portal:

    • Navigate to Microsoft Defender for Cloud.
    • Go to Environment settings > Alert settings > Suppression rules.
    • Create a new rule by selecting an alert and choosing Suppress.
    • Define the scope (e.g., subscription, resource group) and conditions (e.g., alert type, resource ID).

  2. Via REST API:

  3. Review and Audit:

    • Periodically review suppression rules to ensure they are still valid.
    • Avoid over-suppressing alerts that may indicate evolving threats.

Best Practices​

  • Use suppression rules sparingly and only for well-understood, low-risk alerts.
  • Document the rationale for each rule and assign an owner.
  • Regularly audit suppressed alerts to ensure no critical issues are missed.

Failing to manage suppression rules properly can result in missed detections and delayed incident response.

This activity supports the Zero Trust principle of "Assume Breach" by ensuring that only non-critical alerts are suppressed while maintaining visibility into potential threats.

Reference​