Azure / Azure/azure-cli

az security alert update does not change status

Open
#20,487 7 comments 1 reaction 0 assignees View on GitHub
act-codegen-extensibility-squad customer-reported Security Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

I am trying to dismiss a rather large number of the same low severity Microsoft Defender for Cloud Security alert. While that is certainly possible through the Azure portal, I'd rather not click through all 100+ pages of alerts manually to select and change the status of all of them (I've set up a suppression on that particular low severity alert so this doesn't happen again). But I still have a lot to deal with. Enter CLI.

I run `az security alert list -g myRg --query [].name` and grab one of the names returned.

I put the alert name into `az security alert show -l "centralus" -g "myRg" -n ""`. Command shows expected information about the alert, in particular `"status": "Active"`

I run `az security alert update -l "centralus" -g "myRg" -n "" --status "dismiss" --debug`. Seems to run successfully, exit code is 0.

I run `az security alert show -l "centralus" -g "myRg" -n ""`. Still shows `"status": "Active"`. Confusion ensues.

In the portal, I select that alert and change the status to "Dismissed" by hand.

I run `az security alert show -l "centralus" -g "myRg" -n ""`. Now shows `"status": "Dismissed"`. Confusion ensues.

Doesn't matter which alert I do this for, same behavior exhibited every time.

```
az --version

azure-cli 2.30.0

core 2.30.0
telemetry 1.0.6

Extensions:
aks-preview 0.5.39
application-insights 0.1.14
azure-devops 0.21.0
ssh 0.1.8
```
I might try updating these alert statuses en masse through the REST API, but through the CLI seemed like the easier approach first.

---
#### Document Details

⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*

* ID: 3bd1edc5-a15b-0a47-90b5-540732a21e1f
* Version Independent ID: e18a12cb-6f51-5f64-f5be-5437da57b219
* Content: [az security alert](https://docs.microsoft.com/en-us/cli/azure/security/alert?view=azure-cli-latest#az_security_alert_show)
* Content Source: [latest/docs-ref-autogen/security/alert.yml](https://github.com/MicrosoftDocs/azure-docs-cli/blob/master/latest/docs-ref-autogen/security/alert.yml)
* GitHub Login: @rloutlaw
* Microsoft Alias: **routlaw**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.