Suppress Alerts

To disable alerts for behaviors you consider normal or a trusted activity, you can add a suppression to a rule.

Note

• The suppression filters use the same syntax as the search language.
• The suppression test filter works differently from the alert rule test filter. The alert test filter matches the events to the filter expression, and the results box indicates the number of alerts that will be generated. The suppression filter first matches the rule filter expression, compiles all matching events, and removes events that match the suppression filter. Therefore, if you do not see any results, it indicates you would not see alerts.

Add an Alert Suppression to a Rule

To suppress an alert, navigate to the Alerts page.

1. Identify the alert to suppress and click the Suppress Alert button (fire extinguisher icon).

   
   

2. The Add New Suppression dialog displays and shows the suggested suppression filter.

   
   

Note

F5 Distributed Cloud App Infrastructure Protection (AIP) suggests suppression filters based on the event that triggered the alert.

3. You can modify or add additional event parameters to the suppression filter (This step is optional).

   
   

4. Click the Add New Suppression button to save and add the suppression.
5. You can confirm the suppression was added by navigating to the Rules page. Open the associated rule and click the Suppression link. The Suppressions pane is displayed on the right side.

   
   

View or Manually Add a Suppression to a Rule

You can view and add suppression rules on the Rules page.

This example uses the "Users: Logins" rule in the Base Ruleset.

1. Navigate to the Rules page and click the Show More link.

   
   

2. Click the Users: Logins rule. The rule details is displayed in the right view pane.

   
   

3. Click the Suppressions link or scroll to the Suppressions pane on the right side.
4. Click the + New Suppression button to display the filter field.

   
   

5. Add the suppression(s) to the Filter field.

   
   

6. Click the Add New Suppression button.
7. The suppression is saved to the rule.

   
   

Note

In the Suppressions pane, you can view, edit, delete, or add a new suppression.