# Suppress detection alerts

## Serverless Security

When a detection rule runs, it can generate many alerts for similar events—sometimes hundreds of near-identical alerts for the same threat. Alert suppression helps you cut through this noise by grouping related events and creating a single representative alert instead of one alert per event.

## Requirements

- Alert suppression requires the appropriate [subscription](/content/pricing/index.html) for Elastic Stack and Serverless.
- Machine learning rules have [additional requirements](/content/docs/solutions/security/advanced-entity-analytics/machine-learning-job-rule-requirements/index.html) for alert suppression.

## [When to use alert suppression](/content/docs/solutions/security/detect-and-alert/alert-suppression#when-to-use-alert-suppression/index.html)

Alert suppression is useful when:

- A rule generates too many alerts for the same activity (for example, repeated failed login attempts from the same IP address)
- You want to focus analyst attention on unique threats rather than duplicates
- You need to reduce alert volume without weakening your detection coverage

Alert suppression doesn't ignore events—it groups them. You can still investigate all the original events associated with a suppressed alert.

## [How alert suppression works](/content/docs/solutions/security/detect-and-alert/alert-suppression#how-alert-suppression-works/index.html)

Without suppression, a rule creates one alert for every event that matches its criteria. With suppression enabled:

1. You specify one or more fields to group events by (for example, `host.name` or `source.ip`).
2. When multiple events share the same field values, they're grouped together.
3. Instead of creating separate alerts for each event, the rule creates one alert per group.
4. For some rule types, you can also control _how often_ alerts are created:
   - **Per rule execution**: A new alert is created each time the rule runs (if matching events exist).
   - **Per time period**: One alert is created for all matching events within a time window you specify.

## [Configure alert suppression](/content/docs/solutions/security/detect-and-alert/alert-suppression#security-alert-suppression-configure-alert-suppression/index.html)

You can configure alert suppression when [creating](/content/docs/solutions/security/detect-and-alert/using-the-rule-ui/index.html) or editing a rule.

1. ### [Choose fields to group by](/content/docs/solutions/security/detect-and-alert/alert-suppression#choose-fields-to-group-by/index.html)

When configuring the rule (the **Define rule** step for a new rule, or the **Definition** tab for an existing rule), specify how you want to group alerts:

In **Suppress alerts by**, enter one or more field names to group alerts by. Events with the same values for these fields are grouped together.

- Stack9.2+  
      You can enter up to 5 fields.
   - Stack9.0-9.1  
      You can enter up to 3 fields.

For ES|QL rules, fields created in the ES|QL query (for example, with the `EVAL` command) are available to select in **Suppress alerts by**.

2. ### [Choose suppression frequency](/content/docs/solutions/security/detect-and-alert/alert-suppression#choose-suppression-frequency/index.html)

Choose how often to create alerts for qualifying events:
   - **Per rule execution**: Create an alert each time the rule runs and finds matching events.
   - **Per time period**: Create one alert for all matching events that occur within a specified time window. The window starts when an event first matches and creates an alert.

3. ### [Handle missing fields](/content/docs/solutions/security/detect-and-alert/alert-suppression#handle-missing-fields/index.html)

Under **If a suppression field is missing**, choose how to handle events where one or more suppression fields don't exist:
   - **Suppress and group alerts for events with missing fields**: Treat missing fields as having a `null` value. Events with missing fields are grouped together and suppressed.
   - **Do not suppress alerts for events with missing fields**: Create a separate alert for each event with missing fields.

4. ### [Save and enable the rule](/content/docs/solutions/security/detect-and-alert/alert-suppression#save-and-enable-the-rule/index.html)

Configure any other rule settings, then save and enable the rule.

## [Suppression for fields with an array of values](/content/docs/solutions/security/detect-and-alert/alert-suppression#security-alert-suppression-fields-with-multiple-values/index.html)

When you suppress alerts by fields that contain multiple values (arrays), the behavior depends on the rule type:

| Rule type | Behavior |
| --- | --- |
| Custom query or threshold | Alerts are grouped by each unique value separately. For example, if `destination.ip` contains `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, three separate alert groups are created—one for each IP address. |
| Indicator match, event correlation (non-sequence), new terms, ES|QL, or machine learning | Alerts with identical arrays are grouped together. The entire array must match exactly. |
| Event correlation (sequence queries) | Alerts are grouped only if arrays are an exact match _and_ in the same order. |

## [Confirm suppressed alerts](/content/docs/solutions/security/detect-and-alert/alert-suppression#security-alert-suppression-confirm-suppressed-alerts/index.html)

The Elastic Security app shows several indicators when an alert was created with suppression enabled.

### [Alerts table](/content/docs/solutions/security/detect-and-alert/alert-suppression#alerts-table/index.html)

- **Icon in the Rule column**: Hover over the icon to see the number of suppressed alerts.
- **Suppressed alerts count column**: Select **Fields** to open the fields browser, then add `kibana.alert.suppression.docs_count` to the table.

### [Alert details flyout](/content/docs/solutions/security/detect-and-alert/alert-suppression#alert-details-flyout/index.html)

Open the **Insights** > **Correlations** section to see suppression details.

## [Investigate events for suppressed alerts](/content/docs/solutions/security/detect-and-alert/alert-suppression#security-alert-suppression-investigate-events-for-suppressed-alerts/index.html)

Even though suppressed events don't generate their own alerts, you can still access the original events for analysis. Open Timeline with all the events associated with a suppressed alert using one of these methods:

- Alerts table— select **Investigate in timeline** in the **Actions** column.
- Alert details flyout— select **Take action > Investigate in timeline**.

## [Impact of closing suppressed alerts](/content/docs/solutions/security/detect-and-alert/alert-suppression#security-alert-suppression-impact-close-alerts/index.html)

By default, closing a suppressed alert while the suppression window is still active resets suppression. The next qualifying event starts a new suppression window and creates a new alert.

## [Alert suppression limits](/content/docs/solutions/security/detect-and-alert/alert-suppression#security-alert-suppression-alert-suppression-limit-by-rule-type/index.html)

Some rule types limit the number of alerts that can be suppressed. Custom query rules have no suppression limit.

| Rule type | Maximum suppressed alerts |
| --- | --- |
| Threshold, event correlation, ES|QL, and machine learning | Equal to the rule's **Max alerts per run** setting |
| Indicator match and new terms | Five times the rule's **Max alerts per run** setting |

## [Bulk apply or remove alert suppression](/content/docs/solutions/security/detect-and-alert/alert-suppression#security-alert-suppression-bulk-apply/index.html)

You can apply or remove alert suppression from multiple rules at once using the **Bulk actions** menu in the Rules table.