Query

CloudAppEvents
| where ActionType == "Write AlertsSuppressionRules"
| project
     Timestamp,
     ActionType,
     Application,
     AccountId,
     AccountDisplayName,
     CreatedSupresionRule = ObjectName

About this query

List supression rule creations

Query Information

Description

This query lists supression rule creations.

Defender XDR

Sentinel

CloudAppEvents
| where ActionType == "Write AlertsSuppressionRules"
| project
     TimeGenerated,
     ActionType,
     Application,
     AccountId,
     AccountDisplayName,
     CreatedSupresionRule = ObjectName

Explanation

This query is designed to list the creation of suppression rules in a cloud application environment. It filters events where the action type is "Write AlertsSuppressionRules," which indicates the creation of a suppression rule. The query then selects specific details about each event, including:

Timestamp/TimeGenerated: The time when the event occurred.
ActionType: The type of action performed, which in this case is writing (creating) suppression rules.
Application: The application where the action took place.
AccountId: The ID of the account that performed the action.
AccountDisplayName: The display name of the account that performed the action.
CreatedSupresionRule: The name of the suppression rule that was created.

The query is applicable to both Defender XDR and Sentinel environments, with a slight difference in the timestamp field name ("Timestamp" for Defender XDR and "TimeGenerated" for Sentinel).

KQL Search