Which one
| Exception | Suppression | |
|---|---|---|
| Where it applies | Inside one rule | After any match, across rules |
| What it says | "This rule does not apply when …" | "Matches like this are expected in this organization" |
| Typical use | A known administration tool that triggers a process rule | Scheduled vulnerability scanning that triggers many rules |
| Expiry | Optional | Optional |
| Counting | Shown on the rule inspector | Hit counter on the suppression |
Exceptions
Add an exception from the rule page or from an alert with Add rule exception. An exception is a query fragment that is compiled into the rule as a negation, scoped to one organization or all. Give it a reason and, for maintenance windows, an expiry. The rule inspector shows the exceptions in force.
Suppressions
Add a suppression from an alert with Suppress… or from Settings › Suppressions. A suppression matches on entity and rule patterns and is checked before an alert is written, so suppressed matches never reach the queue and never start an SLA clock. Every suppression records why it exists and counts what it has swallowed. A suppression with a large count on a critical rule is worth a second look; the Overview page flags them.
Reviewing
Both lists are visible to leads and admins. Review them monthly: remove what has expired, and question anything whose reason no longer reads well.