services / Azure / Security alert suppression rules

Rules in Microsoft Defender for Cloud that automatically dismiss or suppress security alerts matching defined criteria, preventing matching future alerts from surfacing to responders.

These rules govern which detections reach responders; they affect threat-detection visibility rather than production data directly.

Microsoft.​Security/​alertsSuppressionRules/​write

Pre-creating a suppression rule matching the attacker's own activity ensures future alerts on that activity are auto-dismissed, silently evading detection and preventing those alerts from being recorded/actioned.

Risks

1. Defense destruction (EVASION)
2. Logs destruction (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links