Correlation RulesCorrelation Rules Guide

When a rule over-triggers, it creates noise, can indicate it's detecting false positives, and cause alert fatigue. To prevent a rule from over-triggering, you can suppress the rule from triggering repeatedly when you're creating or editing the rule. With granular suppression, you can suppress the rule from triggering repeatedly on the values of a specified field only. For example, you can suppress the rule from over-triggering on a specific user or source host.

To use granular suppression, you must use the Group by Field functionality in any sequence or designate common properties for the rule.

Within the suppression period, the rule triggers on the first event with a specific field value but is suppressed for all subsequent events with the same field value. For another event with the same field but a different value, the rule triggers again. For example, let's say you designate dest_ip and src_ip as the common properties of a rule and you're using granular suppression with the dest_ip field:

After the suppression period, the rule triggers on all qualifying events.