# Provide alert dimensions when linked storage removes a log query from the payload

> Expected query redaction needs a useful replacement for incident context.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:31:49+00:00
- Modified: 2026-09-17T16:46:30+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Expected query redaction needs a useful replacement for incident context.

## Potentially affected

Use this review for an existing or planned linked-storage arrangement for saved log-alert queries. Identify integrations that currently read the query from an alert payload. Keep the expected redaction behavior separate from whether the rule evaluated successfully and whether notification delivery worked.

## DSE recommendation

DSE recommends reviewing the incident payload contract before changing linked storage.

## Article

## Source facts

Microsoft documents that configuring linked storage for the Alerts data-source type removes the alert query from triggered log-search alert payloads. Alert details show a redaction comment instead. The source explains that the query resides in customer-managed storage and recommends alert dimensions to supply context. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-storage).

## Applicability

Use this review for an existing or planned linked-storage arrangement for saved log-alert queries. Identify integrations that currently read the query from an alert payload. Keep the expected redaction behavior separate from whether the rule evaluated successfully and whether notification delivery worked.

## DSE recommendation

DSE recommends reviewing the incident payload contract before changing linked storage. Identify the context responders need and choose appropriate, non-sensitive alert dimensions. Update consuming workflows to handle a redacted query explicitly rather than failing silently or fetching secrets into a ticket. Agree on an authorized route for analysts who need the saved query itself.

## Verification

Trigger an approved representative alert and inspect the actual payload and downstream incident. Confirm the expected redaction, usable dimensions and successful routing. Verify that an authorized analyst can locate the query through the approved process. Retain a sanitized before-and-after payload comparison so the integration change is grounded in observed behavior.

## Official references

[Microsoft Learn: Use customer-managed storage accounts in Azure Monitor Logs](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-storage).

## Primary reference

- Name: Use customer-managed storage accounts in Azure Monitor Logs - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-storage
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Provide alert dimensions when linked storage removes a log query from the payload,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-191-provide-alert-dimensions-when-linked-storage-removes-a-log-query-from-the-payload/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.