Actions31
- Instance Actions
- Alert Rule Actions
- Automation Rule Actions
- Incident Actions
- Incident Comment Actions
- Query Actions
Alert Rule → Delete
AI-generatedOverview
This node operation deletes an alert rule in Microsoft Sentinel. It is useful for automating the management of security alert rules by programmatically removing obsolete or unwanted alert rules based on their unique identifier (UUID). For example, security teams can integrate this node into workflows to clean up alert rules that are no longer relevant or to enforce policy compliance by removing unauthorized alert rules.
Use Case Examples
- Deleting an alert rule by specifying its Alert Rule ID to maintain an up-to-date security monitoring environment.
- Automating the removal of alert rules as part of a security incident response process.
Properties
| Name | Meaning |
|---|---|
| Sentinel Instance | Specifies the Microsoft Sentinel instance to use. It can be selected from a list, entered as a path in the format {subscriptionId}/{resourceGroupName}/{workspaceName}, or provided as a valid Azure Portal/Management URL. |
| Alert Rule ID | The UUID of the alert rule to delete. This is a required field to identify which alert rule will be removed. |
| Debug | Enables debug mode for the node to provide detailed request and response information during execution. |
| Request Options | Additional settings for the HTTP request such as batching, SSL certificate validation, proxy configuration, and timeout settings. |
Output
JSON
id- The unique identifier of the deleted alert rule.name- The name of the deleted alert rule.type- The resource type of the deleted alert rule.properties- Details about the deleted alert rule, including its configuration and status.
Dependencies
- Requires an OAuth2 API credential for Microsoft Sentinel to authenticate requests.
Troubleshooting
- Ensure the Alert Rule ID is a valid UUID; otherwise, the deletion request will fail.
- Verify that the Sentinel Instance is correctly specified and accessible with the provided credentials.
- If SSL issues occur, consider enabling the 'Ignore SSL Issues' option, but be aware of security implications.
- Check network proxy settings if requests fail due to connectivity issues.
- Common error messages include authorization failures (check OAuth2 credentials) and resource not found (verify Alert Rule ID and Sentinel instance).
Links
- Microsoft Sentinel Alert Rules Documentation - Official Microsoft documentation on managing alert rules in Sentinel.
- Azure REST API Reference for Deleting Alert Rules - API reference for the delete alert rule operation in Microsoft Sentinel.