Suppress detection alerts

Serverless Security

When a detection rule runs, it can generate many alerts for similar events—sometimes hundreds of near-identical alerts for the same threat. Alert suppression helps you cut through this noise by grouping related events and creating a single representative alert instead of one alert per event.

Requirements

• Alert suppression requires the appropriate subscription for Elastic Stack and Serverless.
• Machine learning rules have additional requirements for alert suppression.

When to use alert suppression

Alert suppression is useful when:

• A rule generates too many alerts for the same activity (for example, repeated failed login attempts from the same IP address)
• You want to focus analyst attention on unique threats rather than duplicates
• You need to reduce alert volume without weakening your detection coverage

Alert suppression doesn't ignore events—it groups them. You can still investigate all the original events associated with a suppressed alert.

How alert suppression works

Without suppression, a rule creates one alert for every event that matches its criteria. With suppression enabled:

1. You specify one or more fields to group events by (for example, host.name or source.ip).
2. When multiple events share the same field values, they're grouped together.
3. Instead of creating separate alerts for each event, the rule creates one alert per group.
4. For some rule types, you can also control how often alerts are created:
   • Per rule execution: A new alert is created each time the rule runs (if matching events exist).
   • Per time period: One alert is created for all matching events within a time window you specify.

Configure alert suppression

You can configure alert suppression when creating or editing a rule.

1. Choose fields to group by

When configuring the rule (the Define rule step for a new rule, or the Definition tab for an existing rule), specify how you want to group alerts:

In Suppress alerts by, enter one or more field names to group alerts by. Events with the same values for these fields are grouped together.

• Stack9.2+
  You can enter up to 5 fields.
  • Stack9.0-9.1
    You can enter up to 3 fields.

For ES|QL rules, fields created in the ES|QL query (for example, with the EVAL command) are available to select in Suppress alerts by.

2. Choose suppression frequency

Choose how often to create alerts for qualifying events:

• Per rule execution: Create an alert each time the rule runs and finds matching events.
• Per time period: Create one alert for all matching events that occur within a specified time window. The window starts when an event first matches and creates an alert.

3. Handle missing fields

Under If a suppression field is missing, choose how to handle events where one or more suppression fields don't exist:

• Suppress and group alerts for events with missing fields: Treat missing fields as having a null value. Events with missing fields are grouped together and suppressed.
• Do not suppress alerts for events with missing fields: Create a separate alert for each event with missing fields.

4. Save and enable the rule

Configure any other rule settings, then save and enable the rule.

Suppression for fields with an array of values

When you suppress alerts by fields that contain multiple values (arrays), the behavior depends on the rule type:

Confirm suppressed alerts

The Elastic Security app shows several indicators when an alert was created with suppression enabled.

Alerts table

• Icon in the Rule column: Hover over the icon to see the number of suppressed alerts.
• Suppressed alerts count column: Select Fields to open the fields browser, then add kibana.alert.suppression.docs_count to the table.

Alert details flyout

Open the Insights > Correlations section to see suppression details.

Investigate events for suppressed alerts

Even though suppressed events don't generate their own alerts, you can still access the original events for analysis. Open Timeline with all the events associated with a suppressed alert using one of these methods:

• Alerts table— select Investigate in timeline in the Actions column.
• Alert details flyout— select Take action > Investigate in timeline.

Impact of closing suppressed alerts

By default, closing a suppressed alert while the suppression window is still active resets suppression. The next qualifying event starts a new suppression window and creates a new alert.

Alert suppression limits

Some rule types limit the number of alerts that can be suppressed. Custom query rules have no suppression limit.

Bulk apply or remove alert suppression

You can apply or remove alert suppression from multiple rules at once using the Bulk actions menu in the Rules table.