# Edit the Prometheus rule group after creating recommended Kubernetes alerts

> Use the correct management object when changing an already created alert set.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:29+00:00
- Modified: 2026-09-17T16:38:46+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Use the correct management object when changing an already created alert set.

## Potentially affected

Apply this review to a change request for an existing recommended Kubernetes alert. Identify whether it is based on Prometheus metrics or platform metrics, then locate the actual deployed rule or group. Retain its current enabled state and action configuration before editing.

## DSE recommendation

DSE recommends recording the rule-group resource identifier in the alert runbook when the initial setup completes.

## Article

## Source facts

Microsoft says the portal page used to create recommended Kubernetes alerts cannot edit them after the rule group exists. For Prometheus metrics, operators edit the rule group, including when enabling additional rules. Platform-metric alerts are edited individually instead. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-metric-alerts).

## Applicability

Apply this review to a change request for an existing recommended Kubernetes alert. Identify whether it is based on Prometheus metrics or platform metrics, then locate the actual deployed rule or group. Retain its current enabled state and action configuration before editing.

## DSE recommendation

DSE recommends recording the rule-group resource identifier in the alert runbook when the initial setup completes. Make later edits against that recorded object through the approved management path. Have the on-call owner review the intended rule and condition so a change to one alert does not unintentionally alter other alerts in the group.

## Verification

Read back the rule group after the approved edit and compare each relevant rule with the change request. Exercise a safe test condition and confirm that the intended alert action reaches its owner. Also verify that previously enabled rules retain their expected configuration. Record the object edited and its resulting state so the creation page is not mistaken for the current configuration.

## Official references

[Microsoft Learn: Recommended alert rules for Kubernetes clusters](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-metric-alerts).

## Primary reference

- Name: Recommended alert rules for Kubernetes clusters - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-metric-alerts
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Edit the Prometheus rule group after creating recommended Kubernetes alerts,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-091-edit-the-prometheus-rule-group-after-creating-recommended-kubernetes-alerts/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.