Share via

Alert Rules - Get

  • Reference
Service:
Sentinel
API Version:
2024-03-01

Gets the alert rule.

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}?api-version=2024-03-01

URI Parameters

Name In Required Type Description
resourceGroupName
 path True

string

The name of the resource group. The name is case insensitive.
ruleId
 path True

string

Alert rule ID
subscriptionId
 path True

string

The ID of the target subscription.
workspaceName
 path True

string

The name of the workspace.

Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
api-version
 query True

string

The API version to use for this operation.

Responses

Name Type Description
200 OK AlertRule:

OK, Operation successfully completed
Other Status Codes

CloudError

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

Get a Fusion alert rule.
Get a MicrosoftSecurityIncidentCreation rule.
Get a Scheduled alert rule.

Get a Fusion alert rule.

Sample request

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule?api-version=2024-03-01

Sample response

Status code:
200 
{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule",
  "name": "myFirstFusionRule",
  "etag": "\"260090e2-0000-0d00-0000-5d6fb8670000\"",
  "type": "Microsoft.SecurityInsights/alertRules",
  "kind": "Fusion",
  "properties": {
    "displayName": "Advanced Multi-Stage Attack Detection",
    "description": "In this mode, Sentinel combines low fidelity alerts, which themselves may not be actionable, and events across multiple products, into high fidelity security interesting incidents. The system looks at multiple products to produce actionable incidents. Custom tailored to each tenant, Fusion not only reduces false positive rates but also can detect attacks with limited or missing information. \nIncidents generated by Fusion system will encase two or more alerts. By design, Fusion incidents are low volume, high fidelity and will be high severity, which is why Fusion is turned ON by default in Azure Sentinel.\n\nFor Fusion to work, please configure the following data sources in Data Connectors tab:\nRequired - Azure Active Directory Identity Protection\nRequired - Microsoft Cloud App Security\nIf Available - Palo Alto Network\n\nFor full list of scenarios covered by Fusion, and detail instructions on how to configure the required data sources, go to aka.ms/SentinelFusion",
    "alertRuleTemplateName": "f71aba3d-28fb-450b-b192-4e76a83015c8",
    "tactics": [
      "Persistence",
      "LateralMovement",
      "Exfiltration",
      "CommandAndControl"
    ],
    "severity": "High",
    "enabled": true,
    "lastModifiedUtc": "2019-09-04T13:13:11.5340061Z"
  }
}

Get a MicrosoftSecurityIncidentCreation rule.

Sample request

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample?api-version=2024-03-01

Sample response

Status code:
200 
{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample",
  "name": "microsoftSecurityIncidentCreationRuleExample",
  "etag": "\"260097e0-0000-0d00-0000-5d6fa88f0000\"",
  "type": "Microsoft.SecurityInsights/alertRules",
  "kind": "MicrosoftSecurityIncidentCreation",
  "properties": {
    "productFilter": "Microsoft Cloud App Security",
    "severitiesFilter": null,
    "displayNamesFilter": null,
    "displayName": "testing displayname",
    "enabled": true,
    "description": null,
    "alertRuleTemplateName": null,
    "lastModifiedUtc": "2019-09-04T12:05:35.7296311Z"
  }
}

Get a Scheduled alert rule.

Sample request

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5?api-version=2024-03-01

Sample response

Status code:
200 
{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "type": "Microsoft.SecurityInsights/alertRules",
  "kind": "Scheduled",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "alertRuleTemplateName": null,
    "displayName": "My scheduled rule",
    "description": "An example for a scheduled rule",
    "severity": "High",
    "enabled": true,
    "tactics": [
      "Persistence",
      "LateralMovement"
    ],
    "query": "Heartbeat",
    "queryFrequency": "PT1H",
    "queryPeriod": "P2DT1H30M",
    "triggerOperator": "GreaterThan",
    "triggerThreshold": 0,
    "suppressionDuration": "PT1H",
    "suppressionEnabled": false,
    "lastModifiedUtc": "2019-01-01T13:15:30Z",
    "eventGroupingSettings": {
      "aggregationKind": "AlertPerResult"
    },
    "customDetails": {
      "OperatingSystemName": "OSName",
      "OperatingSystemType": "OSType"
    },
    "entityMappings": [
      {
        "entityType": "Host",
        "fieldMappings": [
          {
            "identifier": "FullName",
            "columnName": "Computer"
          }
        ]
      },
      {
        "entityType": "IP",
        "fieldMappings": [
          {
            "identifier": "Address",
            "columnName": "ComputerIP"
          }
        ]
      }
    ],
    "alertDetailsOverride": {
      "alertDisplayNameFormat": "Alert from {{Computer}}",
      "alertDescriptionFormat": "Suspicious activity was made by {{ComputerIP}}",
      "alertTacticsColumnName": null,
      "alertSeverityColumnName": null
    },
    "incidentConfiguration": {
      "createIncident": true,
      "groupingConfiguration": {
        "enabled": true,
        "reopenClosedIncident": false,
        "lookbackDuration": "PT5H",
        "matchingMethod": "Selected",
        "groupByEntities": [
          "Host"
        ],
        "groupByAlertDetails": [
          "DisplayName"
        ],
        "groupByCustomDetails": [
          "OperatingSystemType",
          "OperatingSystemName"
        ]
      }
    }
  }
}

Definitions

Name Description
AlertDetail

A list of alert details to group by (when matchingMethod is Selected)
AlertDetailsOverride

Settings for how to dynamically override alert static details
AlertProperty

The V3 alert property
AlertPropertyMapping

A single alert property mapping to override
AlertSeverity

The severity for alerts created by this alert rule.
AttackTactic

The severity for alerts created by this alert rule.
CloudError

Error response structure.
CloudErrorBody

Error details.
createdByType

The type of identity that created the resource.
EntityMapping

Single entity mapping for the alert rule
EntityMappingType

The V3 type of the mapped entity
EventGroupingAggregationKind

The event grouping aggregation kinds
EventGroupingSettings

Event grouping settings property bag.
FieldMapping

A single field mapping of the mapped entity
FusionAlertRule

Represents Fusion alert rule.
GroupingConfiguration

Grouping configuration property bag.
IncidentConfiguration

Incident Configuration property bag.
MatchingMethod

Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty.
MicrosoftSecurityIncidentCreationAlertRule

Represents MicrosoftSecurityIncidentCreation rule.
MicrosoftSecurityProductName

The alerts' productName on which the cases will be generated
ScheduledAlertRule

Represents scheduled alert rule.
systemData

Metadata pertaining to creation and last modification of the resource.
TriggerOperator

The operation against the threshold that triggers alert rule.

AlertDetail

A list of alert details to group by (when matchingMethod is Selected)

Name Type Description
DisplayName

string

Alert display name
Severity

string

Alert severity

AlertDetailsOverride

Settings for how to dynamically override alert static details

Name Type Description
alertDescriptionFormat

string

the format containing columns name(s) to override the alert description
alertDisplayNameFormat

string

the format containing columns name(s) to override the alert name
alertDynamicProperties

AlertPropertyMapping[]

List of additional dynamic properties to override
alertSeverityColumnName

string

the column name to take the alert severity from
alertTacticsColumnName

string

the column name to take the alert tactics from

AlertProperty

The V3 alert property

Name Type Description
AlertLink

string

Alert's link
ConfidenceLevel

string

Confidence level property
ConfidenceScore

string

Confidence score
ExtendedLinks

string

Extended links to the alert
ProductComponentName

string

Product component name alert property
ProductName

string

Product name alert property
ProviderName

string

Provider name alert property
RemediationSteps

string

Remediation steps alert property
Techniques

string

Techniques alert property

AlertPropertyMapping

A single alert property mapping to override

Name Type Description
alertProperty

AlertProperty

The V3 alert property
value

string

the column name to use to override this property

AlertSeverity

The severity for alerts created by this alert rule.

Name Type Description
High

string

High severity
Informational

string

Informational severity
Low

string

Low severity
Medium

string

Medium severity

AttackTactic

The severity for alerts created by this alert rule.

Name Type Description
Collection

string

CommandAndControl

string

CredentialAccess

string

DefenseEvasion

string

Discovery

string

Execution

string

Exfiltration

string

Impact

string

ImpairProcessControl

string

InhibitResponseFunction

string

InitialAccess

string

LateralMovement

string

Persistence

string

PreAttack

string

PrivilegeEscalation

string

Reconnaissance

string

ResourceDevelopment

string

CloudError

Error response structure.

Name Type Description
error

CloudErrorBody

Error data

CloudErrorBody

Error details.

Name Type Description
code

string

An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
message

string

A message describing the error, intended to be suitable for display in a user interface.

createdByType

The type of identity that created the resource.

Name Type Description
Application

string

Key

string

ManagedIdentity

string

User

string

EntityMapping

Single entity mapping for the alert rule

Name Type Description
entityType

EntityMappingType

The V3 type of the mapped entity
fieldMappings

FieldMapping[]

array of field mappings for the given entity mapping

EntityMappingType

The V3 type of the mapped entity

Name Type Description
Account

string

User account entity type
AzureResource

string

Azure resource entity type
CloudApplication

string

Cloud app entity type
DNS

string

DNS entity type
File

string

System file entity type
FileHash

string

File-hash entity type
Host

string

Host entity type
IP

string

IP address entity type
MailCluster

string

Mail cluster entity type
MailMessage

string

Mail message entity type
Mailbox

string

Mailbox entity type
Malware

string

Malware entity type
Process

string

Process entity type
RegistryKey

string

Registry key entity type
RegistryValue

string

Registry value entity type
SecurityGroup

string

Security group entity type
SubmissionMail

string

Submission mail entity type
URL

string

URL entity type

EventGroupingAggregationKind

The event grouping aggregation kinds

Name Type Description
AlertPerResult

string

SingleAlert

string

EventGroupingSettings

Event grouping settings property bag.

Name Type Description
aggregationKind

EventGroupingAggregationKind

The event grouping aggregation kinds

FieldMapping

A single field mapping of the mapped entity

Name Type Description
columnName

string

the column name to be mapped to the identifier
identifier

string

the V3 identifier of the entity

FusionAlertRule

Represents Fusion alert rule.

Name Type Description
etag

string

Etag of the azure resource
id

string

Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind string:

Fusion

The alert rule kind
name

string

The name of the resource
properties.alertRuleTemplateName

string

The Name of the alert rule template used to create this rule.
properties.description

string

The description of the alert rule.
properties.displayName

string

The display name for alerts created by this alert rule.
properties.enabled

boolean

Determines whether this alert rule is enabled or disabled.
properties.lastModifiedUtc

string

The last time that this alert has been modified.
properties.severity

AlertSeverity

The severity for alerts created by this alert rule.
properties.tactics

AttackTactic[]

The tactics of the alert rule
properties.techniques

string[]

The techniques of the alert rule
systemData

systemData

Azure Resource Manager metadata containing createdBy and modifiedBy information.
type

string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

GroupingConfiguration

Grouping configuration property bag.

Name Type Description
enabled

boolean

Grouping enabled
groupByAlertDetails

AlertDetail[]

A list of alert details to group by (when matchingMethod is Selected)
groupByCustomDetails

string[]

A list of custom details keys to group by (when matchingMethod is Selected). Only keys defined in the current alert rule may be used.
groupByEntities

EntityMappingType[]

A list of entity types to group by (when matchingMethod is Selected). Only entities defined in the current alert rule may be used.
lookbackDuration

string

Limit the group to alerts created within the lookback duration (in ISO 8601 duration format)
matchingMethod

MatchingMethod

Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty.
reopenClosedIncident

boolean

Re-open closed matching incidents

IncidentConfiguration

Incident Configuration property bag.

Name Type Description
createIncident

boolean

Create incidents from alerts triggered by this analytics rule
groupingConfiguration

GroupingConfiguration

Set how the alerts that are triggered by this analytics rule, are grouped into incidents

MatchingMethod

Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty.

Name Type Description
AllEntities

string

Grouping alerts into a single incident if all the entities match
AnyAlert

string

Grouping any alerts triggered by this rule into a single incident
Selected

string

Grouping alerts into a single incident if the selected entities, custom details and alert details match

MicrosoftSecurityIncidentCreationAlertRule

Represents MicrosoftSecurityIncidentCreation rule.

Name Type Description
etag

string

Etag of the azure resource
id

string

Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind string:

MicrosoftSecurityIncidentCreation

The alert rule kind
name

string

The name of the resource
properties.alertRuleTemplateName

string

The Name of the alert rule template used to create this rule.
properties.description

string

The description of the alert rule.
properties.displayName

string

The display name for alerts created by this alert rule.
properties.displayNamesExcludeFilter

string[]

the alerts' displayNames on which the cases will not be generated
properties.displayNamesFilter

string[]

the alerts' displayNames on which the cases will be generated
properties.enabled

boolean

Determines whether this alert rule is enabled or disabled.
properties.lastModifiedUtc

string

The last time that this alert has been modified.
properties.productFilter

MicrosoftSecurityProductName

The alerts' productName on which the cases will be generated
properties.severitiesFilter

AlertSeverity[]

the alerts' severities on which the cases will be generated
systemData

systemData

Azure Resource Manager metadata containing createdBy and modifiedBy information.
type

string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

MicrosoftSecurityProductName

The alerts' productName on which the cases will be generated

Name Type Description
Azure Active Directory Identity Protection

string

Azure Advanced Threat Protection

string

Azure Security Center

string

Azure Security Center for IoT

string

Microsoft Cloud App Security

string

ScheduledAlertRule

Represents scheduled alert rule.

Name Type Description
etag

string

Etag of the azure resource
id

string

Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind string:

Scheduled

The alert rule kind
name

string

The name of the resource
properties.alertDetailsOverride

AlertDetailsOverride

The alert details override settings
properties.alertRuleTemplateName

string

The Name of the alert rule template used to create this rule.
properties.customDetails

object

Dictionary of string key-value pairs of columns to be attached to the alert
properties.description

string

The description of the alert rule.
properties.displayName

string

The display name for alerts created by this alert rule.
properties.enabled

boolean

Determines whether this alert rule is enabled or disabled.
properties.entityMappings

EntityMapping[]

Array of the entity mappings of the alert rule
properties.eventGroupingSettings

EventGroupingSettings

The event grouping settings.
properties.incidentConfiguration

IncidentConfiguration

The settings of the incidents that created from alerts triggered by this analytics rule
properties.lastModifiedUtc

string

The last time that this alert rule has been modified.
properties.query

string

The query that creates alerts for this rule.
properties.queryFrequency

string

The frequency (in ISO 8601 duration format) for this alert rule to run.
properties.queryPeriod

string

The period (in ISO 8601 duration format) that this alert rule looks at.
properties.severity

AlertSeverity

The severity for alerts created by this alert rule.
properties.suppressionDuration

string

The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.
properties.suppressionEnabled

boolean

Determines whether the suppression for this alert rule is enabled or disabled.
properties.tactics

AttackTactic[]

The tactics of the alert rule
properties.techniques

string[]

The techniques of the alert rule
properties.templateVersion

string

The version of the alert rule template used to create this rule - in format <a.b.c>, where all are numbers, for example 0 <1.0.2>
properties.triggerOperator

TriggerOperator

The operation against the threshold that triggers alert rule.
properties.triggerThreshold

integer

The threshold triggers this alert rule.
systemData

systemData

Azure Resource Manager metadata containing createdBy and modifiedBy information.
type

string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

systemData

Metadata pertaining to creation and last modification of the resource.

Name Type Description
createdAt

string

The timestamp of resource creation (UTC).
createdBy

string

The identity that created the resource.
createdByType

createdByType

The type of identity that created the resource.
lastModifiedAt

string

The timestamp of resource last modification (UTC)
lastModifiedBy

string

The identity that last modified the resource.
lastModifiedByType

createdByType

The type of identity that last modified the resource.

TriggerOperator

The operation against the threshold that triggers alert rule.

Name Type Description
Equal

string

GreaterThan

string

LessThan

string

NotEqual

string