{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior/",
        "slug": "dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior/"
        },
        "title": "Check an active metric alert before changing repeat-notification behavior",
        "summary": "Why can a continuing metric breach produce no new alert, and what changes if the rule becomes stateless?",
        "format": {
            "slug": "explainer",
            "name": "Explainer"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:29:59+00:00",
        "modified_at": "2026-09-10T00:52:38+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 245,
        "potentially_affected": "Azure Monitor metric alert rules.",
        "dse_recommendation": "Inspect the existing alert's state before disabling automatic resolution to obtain repeat notifications.",
        "primary_source": {
            "name": "Troubleshoot Azure Monitor metric alerts - Azure Monitor | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-metric",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Metric alerts are stateful by default. Once a time series has a fired alert, another alert for that series is not fired while the problem persists. Automatic resolution follows three consecutive evaluations that no longer meet the condition. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-metric\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<p>Setting autoMitigate to false, or clearing Automatically resolve alerts in the portal, makes a metric rule stateless. This also prevents its fired alerts from resolving; they remain fired for their thirty-day retention period. Microsoft documents notification timing ranges for stateless rules rather than a single exact delivery interval. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-metric\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Use this distinction for Azure Monitor metric alert rules. Identify the exact metric time series and existing alert before interpreting silence as a rule failure. Keep alert generation separate from the investigation of a failed notification channel.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends choosing lifecycle behavior deliberately. Ask whether the response process needs one continuing incident or repeated notifications, then document how responders will handle the resulting records. Do not clear automatic resolution merely to make an alert appear again during troubleshooting. Preserve the previous rule definition and obtain agreement from the receiving team before changing the behavior.</p>\n<h2>Verification</h2>\n<p>In an approved test, sustain a breach and then clear it. Observe the fired record, subsequent evaluations and resolution behavior under the selected configuration. Correlate notifications separately. Keep the time-series identity and rule setting with the observations so a reviewer can distinguish stateful suppression from a delivery problem.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-metric\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Troubleshoot metric alerts</a>.</p>",
        "content_text": "Source facts\nMetric alerts are stateful by default. Once a time series has a fired alert, another alert for that series is not fired while the problem persists. Automatic resolution follows three consecutive evaluations that no longer meet the condition. Microsoft Learn.\nSetting autoMitigate to false, or clearing Automatically resolve alerts in the portal, makes a metric rule stateless. This also prevents its fired alerts from resolving; they remain fired for their thirty-day retention period. Microsoft documents notification timing ranges for stateless rules rather than a single exact delivery interval. Microsoft Learn.\nApplicability\nUse this distinction for Azure Monitor metric alert rules. Identify the exact metric time series and existing alert before interpreting silence as a rule failure. Keep alert generation separate from the investigation of a failed notification channel.\nDSE recommendation\nDSE recommends choosing lifecycle behavior deliberately. Ask whether the response process needs one continuing incident or repeated notifications, then document how responders will handle the resulting records. Do not clear automatic resolution merely to make an alert appear again during troubleshooting. Preserve the previous rule definition and obtain agreement from the receiving team before changing the behavior.\nVerification\nIn an approved test, sustain a breach and then clear it. Observe the fired record, subsequent evaluations and resolution behavior under the selected configuration. Correlate notifications separately. Keep the time-series identity and rule setting with the observations so a reviewer can distinguish stateful suppression from a delivery problem.\nOfficial references\nMicrosoft Learn: Troubleshoot metric alerts.",
        "content_markdown": "## Source facts\n\nMetric alerts are stateful by default. Once a time series has a fired alert, another alert for that series is not fired while the problem persists. Automatic resolution follows three consecutive evaluations that no longer meet the condition. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-metric).\n\nSetting autoMitigate to false, or clearing Automatically resolve alerts in the portal, makes a metric rule stateless. This also prevents its fired alerts from resolving; they remain fired for their thirty-day retention period. Microsoft documents notification timing ranges for stateless rules rather than a single exact delivery interval. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-metric).\n\n## Applicability\n\nUse this distinction for Azure Monitor metric alert rules. Identify the exact metric time series and existing alert before interpreting silence as a rule failure. Keep alert generation separate from the investigation of a failed notification channel.\n\n## DSE recommendation\n\nDSE recommends choosing lifecycle behavior deliberately. Ask whether the response process needs one continuing incident or repeated notifications, then document how responders will handle the resulting records. Do not clear automatic resolution merely to make an alert appear again during troubleshooting. Preserve the previous rule definition and obtain agreement from the receiving team before changing the behavior.\n\n## Verification\n\nIn an approved test, sustain a breach and then clear it. Observe the fired record, subsequent evaluations and resolution behavior under the selected configuration. Correlate notifications separately. Keep the time-series identity and rule setting with the observations so a reviewer can distinguish stateful suppression from a delivery problem.\n\n## Official references\n\n[Microsoft Learn: Troubleshoot metric alerts](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-metric)."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Check an active metric alert before changing repeat-notification behavior",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior/",
                "headline": "Check an active metric alert before changing repeat-notification behavior",
                "description": "Why can a continuing metric breach produce no new alert, and what changes if the rule becomes stateless?",
                "abstract": "Why can a continuing metric breach produce no new alert, and what changes if the rule becomes stateless?",
                "articleBody": "Source facts\nMetric alerts are stateful by default. Once a time series has a fired alert, another alert for that series is not fired while the problem persists. Automatic resolution follows three consecutive evaluations that no longer meet the condition. Microsoft Learn.\nSetting autoMitigate to false, or clearing Automatically resolve alerts in the portal, makes a metric rule stateless. This also prevents its fired alerts from resolving; they remain fired for their thirty-day retention period. Microsoft documents notification timing ranges for stateless rules rather than a single exact delivery interval. Microsoft Learn.\nApplicability\nUse this distinction for Azure Monitor metric alert rules. Identify the exact metric time series and existing alert before interpreting silence as a rule failure. Keep alert generation separate from the investigation of a failed notification channel.\nDSE recommendation\nDSE recommends choosing lifecycle behavior deliberately. Ask whether the response process needs one continuing incident or repeated notifications, then document how responders will handle the resulting records. Do not clear automatic resolution merely to make an alert appear again during troubleshooting. Preserve the previous rule definition and obtain agreement from the receiving team before changing the behavior.\nVerification\nIn an approved test, sustain a breach and then clear it. Observe the fired record, subsequent evaluations and resolution behavior under the selected configuration. Correlate notifications separately. Keep the time-series identity and rule setting with the observations so a reviewer can distinguish stateful suppression from a delivery problem.\nOfficial references\nMicrosoft Learn: Troubleshoot metric alerts.",
                "datePublished": "2026-09-10T00:29:59+00:00",
                "dateModified": "2026-09-10T00:52:38+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-117-check-an-active-metric-alert-before-changing-repeat-notification-behavior/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Check an active metric alert before changing repeat-notification behavior"
                },
                "articleSection": [
                    "Business Continuity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Business Continuity",
                    "Networks & Infrastructure",
                    "Explainer",
                    "Information priority"
                ],
                "genre": "Explainer",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 245,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Troubleshoot Azure Monitor metric alerts - Azure Monitor | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-metric"
                }
            }
        ]
    }
}