Skip to content

[8.19] Bulk-apply and remove alert suppression #6936

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 2 commits into
base: 8.19
Choose a base branch
from
Draft

[8.19] Bulk-apply and remove alert suppression #6936

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dedbcb6
First draft
nastasha-solomon Jul 17, 2025
f2f9674
added missing char
nastasha-solomon Jul 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion docs/detections/alert-suppression.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,4 +113,10 @@ image::images/timeline-button.png[Investigate in timeline button, 200]
Some rule types have a maximum number of alerts that can be suppressed (custom query rules don't have a suppression limit):

* **Threshold, event correlation, {esql}, and {ml}:** The maximum number of alerts is the value you choose for the rule's **Max alerts per run** <<rule-ui-advanced-params,advanced setting>>, which is `100` by default.
* **Indicator match and new terms:** The maximum number is five times the value you choose for the rule's **Max alerts per run** <<rule-ui-advanced-params,advanced setting>>. The default value is `100`, which means the default maximum limit for indicator match rules and new term rules is `500`.
* **Indicator match and new terms:** The maximum number is five times the value you choose for the rule's **Max alerts per run** <<rule-ui-advanced-params,advanced setting>>. The default value is `100`, which means the default maximum limit for indicator match rules and new term rules is `500`.

[float]
[[alert-suppression-bulk-apply]]
=== Bulk apply and remove alert suppression

From the Rules table, use the **Bulk actions** menu to apply or remove alert suppression to multiple rules. The **Apply alert suppression** option can be used for all rules types except for the threshold rule type. To bulk-apply alert suppression to threshold rules, use the bulk menu option that's labeled for threshold rules only.