Document AlertAndBlock action and clarify GenerateAlert mapping#504
Document AlertAndBlock action and clarify GenerateAlert mapping#504jongABCDsudo-rm-rf wants to merge 2 commits into
Conversation
|
@jongABCDsudo-rm-rf : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
prmerger-automator
Bot
added
asr/subsvc
Change sent to author
defender-endpoint/svc
labels
|
Learn Build status updates of commit b8efdfd: ✅ Validation status: passed
For more details, please refer to the build report. |
|
Learn Build status updates of commit fc88a5f: ✅ Validation status: passed
For more details, please refer to the build report. |
|
Can you review the proposed changes? Important: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
prmerger-automator
Bot
added
the
aq-pr-triaged
|
@jongABCDsudo-rm-rf : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
There was a problem hiding this comment.
Pull request overview
This PR updates the Manage indicators documentation to include the AlertAndBlock action for indicator imports/API usage and explain how it relates to existing action/alert settings.
Changes:
- Added
AlertAndBlockto the supportedactionvalues list. - Clarified how
AlertAndBlockrelates toBlockAndRemediateand alert generation.
| | category|String|Category of the alert. Examples include: Execution and credential access. <br/>**Optional** | | ||
| | mitretechniques|String|MITRE techniques code/id (comma separated). For more information, see [Enterprise tactics](https://attack.mitre.org/tactics/enterprise/). <br/> **Optional** <br/>It's recommended to add a value in category when a MITRE technique. | | ||
| | GenerateAlert|String|Whether the alert should be generated. Possible Values are: `True` or `False`. <br/>**Optional** | | ||
| | GenerateAlert|String|Whether the alert should be generated. Possible Values are: `True` or `False`. The API action `AlertAndBlock` is equivalent to setting `action` to `BlockAndRemediate` with `GenerateAlert=True` (rendered in the portal as "Block and remediate" with "Generate alert" ticked). <br/>**Optional** | |
Adds documentation for the AlertAndBlock action value supported by the Indicators API and clarifies its relationship to the existing BlockAndRemediate action and GenerateAlert parameter.
Indicators API accepts AlertAndBlock as a valid value for the action parameter, but it isn't listed in the supported parameters table on this page. Customers importing IoCs via CSV or calling the API directly currently have no documented reference for this value.
Functionally, AlertAndBlock on the API is equivalent to submitting action=BlockAndRemediate together with GenerateAlert=True. Seen in the Microsoft Defender portal, inputs render identically as Block and remediate with the Generate alert checkbox ticked.