Azure Alert Suppression Rule Created or Modified

AnalysisType: rule
Filename: azure_alert_suppression_rule_created.py
RuleID: "Azure.MonitorActivity.Security.AlertSuppressionRuleCreated"
DisplayName: "Azure Alert Suppression Rule Created or Modified"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Low
Description: >
  Detects when an Azure Security Center alert suppression rule is created or modified.
  Alert suppression rules allow filtering of specific security alerts to reduce noise,
  but adversaries may abuse this feature to silence alerts related to their malicious
  activities. While legitimate use cases exist (suppressing known false positives), new
  suppression rules should be reviewed to ensure they don't hide indicators of compromise.
Reports:
  MITRE ATT&CK:
    - TA0005:T1562 # Defense Evasion: Impair Defenses
Tags:
  - Defense Evasion
  - Impair Defenses
Runbook: |
  1. Query Azure Monitor Activity logs for all security control operations (alert suppression rules, alert rule deletions, diagnostic settings deletions) by the callerIpAddress in the 24 hours before and after the alert
  2. Find all alert suppression rule creations in the past 6 hours to determine if multiple alerts are being suppressed to hide malicious activity
  3. Check if the callerIpAddress has created alert suppression rules in the past 90 days to establish if this is typical security operations activity
Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Alert Suppression Rule Created
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/providers/Microsoft.Security/alertsSuppressionRules/SuppressFalsePositives",
        "operationName": "MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE",
        "operationVersion": "2019-01-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "level": "Informational",
        "location": "global",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Alert Suppression Rule Modified Case Insensitive
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T11:15:00.0000000Z",
        "resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.Security/alertsSuppressionRules/IgnoreTestAlerts",
        "operationName": "microsoft.security/alertssuppressionrules/write",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "2.2.2.2",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f23456789012",
        "level": "Information",
        "location": "global",
        "tenantId": "22222222-2222-2222-2222-222222222222"
      }
  - Name: Different Security Operation
    ExpectedResult: false
    Log:
      {
        "time": "2025-12-22T14:00:00.0000000Z",
        "resourceId": "/subscriptions/55555555-5555-5555-5555-555555555555/providers/Microsoft.Security/securityContacts/default",
        "operationName": "MICROSOFT.SECURITY/SECURITYCONTACTS/WRITE",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "5.5.5.5",
        "correlationId": "e5f6a7b8-c9d0-1234-ef01-567890123456",
        "tenantId": "55555555-5555-5555-5555-555555555555"
      }

# ------ paired body: azure_alert_suppression_rule_created.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

ALERT_SUPPRESSION_WRITE_OPERATION = "MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE"


def rule(event):
    return all(
        [
            event.get("operationName", "").upper() == ALERT_SUPPRESSION_WRITE_OPERATION,
            azure_activity_success(event),
        ]
    )


def title(event):
    resource_id = event.get("resourceId", "<UNKNOWN_RESOURCE>")

    rule_name = extract_resource_name_from_id(
        resource_id, "alertsSuppressionRules", default="<UNKNOWN_RULE_NAME>"
    )

    return f"Azure Alert Suppression Rule Created or Modified: [{rule_name}]"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")
    rule_name = extract_resource_name_from_id(resource_id, "alertsSuppressionRules", default="")
    if rule_name:
        context["suppression_rule_name"] = rule_name

    return context