services / Azure / Security alert resolution

The action that sets a Microsoft Defender for Cloud security alert's state to resolved, marking it as handled and removing it from the active alert queue.

Changes the state of an already-fired detection to hide it from responders; affects incident visibility rather than production data.

Microsoft.​Security/​locations/​alerts/​resolve/​action

Resolving an active alert prematurely closes a detection of the attacker's activity and manipulates its state to appear handled, evading incident response.

Risks

1. Data manipulation (HIGH)
2. Defense destruction (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links