{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/", "slug": "dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts", "url": "https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/" }, "title": "Edit the Prometheus rule group after creating recommended Kubernetes alerts", "summary": "Use the correct management object when changing an already created alert set.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:29+00:00", "modified_at": "2026-09-17T16:38:46+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 213, "potentially_affected": "Apply this review to a change request for an existing recommended Kubernetes alert. Identify whether it is based on Prometheus metrics or platform metrics, then locate the actual deployed rule or group. Retain its current enabled state and action configuration before editing.", "dse_recommendation": "DSE recommends recording the rule-group resource identifier in the alert runbook when the initial setup completes.", "primary_source": { "name": "Recommended alert rules for Kubernetes clusters - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-metric-alerts", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft says the portal page used to create recommended Kubernetes alerts cannot edit them after the rule group exists. For Prometheus metrics, operators edit the rule group, including when enabling additional rules. Platform-metric alerts are edited individually instead. Microsoft Learn.

\n

Applicability

\n

Apply this review to a change request for an existing recommended Kubernetes alert. Identify whether it is based on Prometheus metrics or platform metrics, then locate the actual deployed rule or group. Retain its current enabled state and action configuration before editing.

\n

DSE recommendation

\n

DSE recommends recording the rule-group resource identifier in the alert runbook when the initial setup completes. Make later edits against that recorded object through the approved management path. Have the on-call owner review the intended rule and condition so a change to one alert does not unintentionally alter other alerts in the group.

\n

Verification

\n

Read back the rule group after the approved edit and compare each relevant rule with the change request. Exercise a safe test condition and confirm that the intended alert action reaches its owner. Also verify that previously enabled rules retain their expected configuration. Record the object edited and its resulting state so the creation page is not mistaken for the current configuration.

\n

Official references

\n

Microsoft Learn: Recommended alert rules for Kubernetes clusters.

", "content_text": "Source facts\nMicrosoft says the portal page used to create recommended Kubernetes alerts cannot edit them after the rule group exists. For Prometheus metrics, operators edit the rule group, including when enabling additional rules. Platform-metric alerts are edited individually instead. Microsoft Learn.\nApplicability\nApply this review to a change request for an existing recommended Kubernetes alert. Identify whether it is based on Prometheus metrics or platform metrics, then locate the actual deployed rule or group. Retain its current enabled state and action configuration before editing.\nDSE recommendation\nDSE recommends recording the rule-group resource identifier in the alert runbook when the initial setup completes. Make later edits against that recorded object through the approved management path. Have the on-call owner review the intended rule and condition so a change to one alert does not unintentionally alter other alerts in the group.\nVerification\nRead back the rule group after the approved edit and compare each relevant rule with the change request. Exercise a safe test condition and confirm that the intended alert action reaches its owner. Also verify that previously enabled rules retain their expected configuration. Record the object edited and its resulting state so the creation page is not mistaken for the current configuration.\nOfficial references\nMicrosoft Learn: Recommended alert rules for Kubernetes clusters.", "content_markdown": "## Source facts\n\nMicrosoft says the portal page used to create recommended Kubernetes alerts cannot edit them after the rule group exists. For Prometheus metrics, operators edit the rule group, including when enabling additional rules. Platform-metric alerts are edited individually instead. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-metric-alerts).\n\n## Applicability\n\nApply this review to a change request for an existing recommended Kubernetes alert. Identify whether it is based on Prometheus metrics or platform metrics, then locate the actual deployed rule or group. Retain its current enabled state and action configuration before editing.\n\n## DSE recommendation\n\nDSE recommends recording the rule-group resource identifier in the alert runbook when the initial setup completes. Make later edits against that recorded object through the approved management path. Have the on-call owner review the intended rule and condition so a change to one alert does not unintentionally alter other alerts in the group.\n\n## Verification\n\nRead back the rule group after the approved edit and compare each relevant rule with the change request. Exercise a safe test condition and confirm that the intended alert action reaches its owner. Also verify that previously enabled rules retain their expected configuration. Record the object edited and its resulting state so the creation page is not mistaken for the current configuration.\n\n## Official references\n\n[Microsoft Learn: Recommended alert rules for Kubernetes clusters](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-metric-alerts)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/", "url": "https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Edit the Prometheus rule group after creating recommended Kubernetes alerts", "item": "https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/", "url": "https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/", "headline": "Edit the Prometheus rule group after creating recommended Kubernetes alerts", "description": "Use the correct management object when changing an already created alert set.", "abstract": "Use the correct management object when changing an already created alert set.", "articleBody": "Source facts\nMicrosoft says the portal page used to create recommended Kubernetes alerts cannot edit them after the rule group exists. For Prometheus metrics, operators edit the rule group, including when enabling additional rules. Platform-metric alerts are edited individually instead. Microsoft Learn.\nApplicability\nApply this review to a change request for an existing recommended Kubernetes alert. Identify whether it is based on Prometheus metrics or platform metrics, then locate the actual deployed rule or group. Retain its current enabled state and action configuration before editing.\nDSE recommendation\nDSE recommends recording the rule-group resource identifier in the alert runbook when the initial setup completes. Make later edits against that recorded object through the approved management path. Have the on-call owner review the intended rule and condition so a change to one alert does not unintentionally alter other alerts in the group.\nVerification\nRead back the rule group after the approved edit and compare each relevant rule with the change request. Exercise a safe test condition and confirm that the intended alert action reaches its owner. Also verify that previously enabled rules retain their expected configuration. Record the object edited and its resulting state so the creation page is not mistaken for the current configuration.\nOfficial references\nMicrosoft Learn: Recommended alert rules for Kubernetes clusters.", "datePublished": "2026-09-17T16:33:29+00:00", "dateModified": "2026-09-17T16:38:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Edit the Prometheus rule group after creating recommended Kubernetes alerts" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 213, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Recommended alert rules for Kubernetes clusters - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-metric-alerts" } } ] } }