az security alert update does not change status
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
I am trying to dismiss a rather large number of the same low severity Microsoft Defender for Cloud Security alert. While that is certainly possible through the Azure portal, I'd rather not click through all 100+ pages of alerts manually to select and change the status of all of them (I've set up a suppression on that particular low severity alert so this doesn't happen again). But I still have a lot to deal with. Enter CLI.
I run `az security alert list -g myRg --query [].name` and grab one of the names returned.
I put the alert name into `az security alert show -l "centralus" -g "myRg" -n ""`. Command shows expected information about the alert, in particular `"status": "Active"`
I run `az security alert update -l "centralus" -g "myRg" -n "" --status "dismiss" --debug`. Seems to run successfully, exit code is 0.
I run `az security alert show -l "centralus" -g "myRg" -n ""`. Still shows `"status": "Active"`. Confusion ensues.
In the portal, I select that alert and change the status to "Dismissed" by hand.
I run `az security alert show -l "centralus" -g "myRg" -n ""`. Now shows `"status": "Dismissed"`. Confusion ensues.
Doesn't matter which alert I do this for, same behavior exhibited every time.
```
az --version
azure-cli 2.30.0
core 2.30.0
telemetry 1.0.6
Extensions:
aks-preview 0.5.39
application-insights 0.1.14
azure-devops 0.21.0
ssh 0.1.8
```
I might try updating these alert statuses en masse through the REST API, but through the CLI seemed like the easier approach first.
---
#### Document Details
⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*
* ID: 3bd1edc5-a15b-0a47-90b5-540732a21e1f
* Version Independent ID: e18a12cb-6f51-5f64-f5be-5437da57b219
* Content: [az security alert](https://docs.microsoft.com/en-us/cli/azure/security/alert?view=azure-cli-latest#az_security_alert_show)
* Content Source: [latest/docs-ref-autogen/security/alert.yml](https://github.com/MicrosoftDocs/azure-docs-cli/blob/master/latest/docs-ref-autogen/security/alert.yml)
* GitHub Login: @rloutlaw
* Microsoft Alias: **routlaw**
Contributor guide
Assessment
This issue has not been assessed yet.