GuideInformationCybersecurityIT

Edit the Prometheus rule group after creating recommended Kubernetes alerts

Use the correct management object when changing an already created alert set.

Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.
DSE visual intelligenceCyber defenseGuide · 1 min read
Executive summary

What you need to know

Use the correct management object when changing an already created alert set.

Potentially affected

Apply this review to a change request for an existing recommended Kubernetes alert. Identify whether it is based on Prometheus metrics or platform metrics, then locate the actual deployed rule or group. Retain its current enabled state and action configuration before editing.

DSE recommendation

DSE recommends recording the rule-group resource identifier in the alert runbook when the initial setup completes.

Source facts

Microsoft says the portal page used to create recommended Kubernetes alerts cannot edit them after the rule group exists. For Prometheus metrics, operators edit the rule group, including when enabling additional rules. Platform-metric alerts are edited individually instead. Microsoft Learn.

Applicability

Apply this review to a change request for an existing recommended Kubernetes alert. Identify whether it is based on Prometheus metrics or platform metrics, then locate the actual deployed rule or group. Retain its current enabled state and action configuration before editing.

DSE recommendation

DSE recommends recording the rule-group resource identifier in the alert runbook when the initial setup completes. Make later edits against that recorded object through the approved management path. Have the on-call owner review the intended rule and condition so a change to one alert does not unintentionally alter other alerts in the group.

Verification

Read back the rule group after the approved edit and compare each relevant rule with the change request. Exercise a safe test condition and confirm that the intended alert action reaches its owner. Also verify that previously enabled rules retain their expected configuration. Record the object edited and its resulting state so the creation page is not mistaken for the current configuration.

Official references

Microsoft Learn: Recommended alert rules for Kubernetes clusters.

Primary reference

Review the official source

Recommended alert rules for Kubernetes clusters - Azure Monitor | Microsoft Learn · Verified September 17, 2026

Open official reference ↗
Plan the next step

Need help applying this guidance safely?

DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.

Talk with DSE