Symptoms
- You added a suppression filter but the same alerts continue to appear.
- Risk score for a suppressed entity is not decreasing.
Causes
- Filter scope mismatch — The filter doesn't match the exact field values in the events.
- Delayed application — Suppression filters apply to new events, not retroactively.
- Wildcard syntax error — Incorrect wildcard or CIDR syntax in the filter.
Solution
1. Verify Filter Matches
Open the Scoreboard and click the risk object you're trying to suppress. Check the detection event field values and ensure they exactly match your filter criteria.
2. Wait for New Events
Suppression filters only apply to events generated after the filter is created. Existing risk scores will decay naturally over the time window but won't be retroactively removed.
3. Check Syntax
- Wildcards: Use
*for any characters (e.g.,*.internal.corp). - CIDR: Use standard notation (e.g.,
10.0.0.0/8). - Exact match: No wildcards needed for exact values.