{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/", "slug": "dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload", "url": "https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/" }, "title": "Provide alert dimensions when linked storage removes a log query from the payload", "summary": "Expected query redaction needs a useful replacement for incident context.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:31:49+00:00", "modified_at": "2026-09-17T16:46:30+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 210, "potentially_affected": "Use this review for an existing or planned linked-storage arrangement for saved log-alert queries. Identify integrations that currently read the query from an alert payload. Keep the expected redaction behavior separate from whether the rule evaluated successfully and whether notification delivery worked.", "dse_recommendation": "DSE recommends reviewing the incident payload contract before changing linked storage.", "primary_source": { "name": "Use customer-managed storage accounts in Azure Monitor Logs - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-storage", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents that configuring linked storage for the Alerts data-source type removes the alert query from triggered log-search alert payloads. Alert details show a redaction comment instead. The source explains that the query resides in customer-managed storage and recommends alert dimensions to supply context. Microsoft Learn.

\n

Applicability

\n

Use this review for an existing or planned linked-storage arrangement for saved log-alert queries. Identify integrations that currently read the query from an alert payload. Keep the expected redaction behavior separate from whether the rule evaluated successfully and whether notification delivery worked.

\n

DSE recommendation

\n

DSE recommends reviewing the incident payload contract before changing linked storage. Identify the context responders need and choose appropriate, non-sensitive alert dimensions. Update consuming workflows to handle a redacted query explicitly rather than failing silently or fetching secrets into a ticket. Agree on an authorized route for analysts who need the saved query itself.

\n

Verification

\n

Trigger an approved representative alert and inspect the actual payload and downstream incident. Confirm the expected redaction, usable dimensions and successful routing. Verify that an authorized analyst can locate the query through the approved process. Retain a sanitized before-and-after payload comparison so the integration change is grounded in observed behavior.

\n

Official references

\n

Microsoft Learn: Use customer-managed storage accounts in Azure Monitor Logs.

", "content_text": "Source facts\nMicrosoft documents that configuring linked storage for the Alerts data-source type removes the alert query from triggered log-search alert payloads. Alert details show a redaction comment instead. The source explains that the query resides in customer-managed storage and recommends alert dimensions to supply context. Microsoft Learn.\nApplicability\nUse this review for an existing or planned linked-storage arrangement for saved log-alert queries. Identify integrations that currently read the query from an alert payload. Keep the expected redaction behavior separate from whether the rule evaluated successfully and whether notification delivery worked.\nDSE recommendation\nDSE recommends reviewing the incident payload contract before changing linked storage. Identify the context responders need and choose appropriate, non-sensitive alert dimensions. Update consuming workflows to handle a redacted query explicitly rather than failing silently or fetching secrets into a ticket. Agree on an authorized route for analysts who need the saved query itself.\nVerification\nTrigger an approved representative alert and inspect the actual payload and downstream incident. Confirm the expected redaction, usable dimensions and successful routing. Verify that an authorized analyst can locate the query through the approved process. Retain a sanitized before-and-after payload comparison so the integration change is grounded in observed behavior.\nOfficial references\nMicrosoft Learn: Use customer-managed storage accounts in Azure Monitor Logs.", "content_markdown": "## Source facts\n\nMicrosoft documents that configuring linked storage for the Alerts data-source type removes the alert query from triggered log-search alert payloads. Alert details show a redaction comment instead. The source explains that the query resides in customer-managed storage and recommends alert dimensions to supply context. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-storage).\n\n## Applicability\n\nUse this review for an existing or planned linked-storage arrangement for saved log-alert queries. Identify integrations that currently read the query from an alert payload. Keep the expected redaction behavior separate from whether the rule evaluated successfully and whether notification delivery worked.\n\n## DSE recommendation\n\nDSE recommends reviewing the incident payload contract before changing linked storage. Identify the context responders need and choose appropriate, non-sensitive alert dimensions. Update consuming workflows to handle a redacted query explicitly rather than failing silently or fetching secrets into a ticket. Agree on an authorized route for analysts who need the saved query itself.\n\n## Verification\n\nTrigger an approved representative alert and inspect the actual payload and downstream incident. Confirm the expected redaction, usable dimensions and successful routing. Verify that an authorized analyst can locate the query through the approved process. Retain a sanitized before-and-after payload comparison so the integration change is grounded in observed behavior.\n\n## Official references\n\n[Microsoft Learn: Use customer-managed storage accounts in Azure Monitor Logs](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-storage)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/", "url": "https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Provide alert dimensions when linked storage removes a log query from the payload", "item": "https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/", "url": "https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/", "headline": "Provide alert dimensions when linked storage removes a log query from the payload", "description": "Expected query redaction needs a useful replacement for incident context.", "abstract": "Expected query redaction needs a useful replacement for incident context.", "articleBody": "Source facts\nMicrosoft documents that configuring linked storage for the Alerts data-source type removes the alert query from triggered log-search alert payloads. Alert details show a redaction comment instead. The source explains that the query resides in customer-managed storage and recommends alert dimensions to supply context. Microsoft Learn.\nApplicability\nUse this review for an existing or planned linked-storage arrangement for saved log-alert queries. Identify integrations that currently read the query from an alert payload. Keep the expected redaction behavior separate from whether the rule evaluated successfully and whether notification delivery worked.\nDSE recommendation\nDSE recommends reviewing the incident payload contract before changing linked storage. Identify the context responders need and choose appropriate, non-sensitive alert dimensions. Update consuming workflows to handle a redacted query explicitly rather than failing silently or fetching secrets into a ticket. Agree on an authorized route for analysts who need the saved query itself.\nVerification\nTrigger an approved representative alert and inspect the actual payload and downstream incident. Confirm the expected redaction, usable dimensions and successful routing. Verify that an authorized analyst can locate the query through the approved process. Retain a sanitized before-and-after payload comparison so the integration change is grounded in observed behavior.\nOfficial references\nMicrosoft Learn: Use customer-managed storage accounts in Azure Monitor Logs.", "datePublished": "2026-09-17T16:31:49+00:00", "dateModified": "2026-09-17T16:46:30+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Provide alert dimensions when linked storage removes a log query from the payload" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 210, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Use customer-managed storage accounts in Azure Monitor Logs - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-storage" } } ] } }