Which one
| Exception | Suppression | |
|---|---|---|
| Where it applies | Inside one rule | After any match, across rules |
| What it says | "This rule does not apply when …" | "Matches like this are expected in this organization" |
| Typical use | A known administration tool that triggers a process rule | Scheduled vulnerability scanning that triggers many rules |
| Expiry | Optional | Optional |
| Counting | Shown on the rule inspector | Hit counter on the suppression |
Exceptions
Add an exception in the rule editor's Exceptions section, or from an alert with Add rule exception. An exception is a set of conditions that must all match; matching events are never counted by the rule. Give it a reason and, for maintenance windows, an expiry. Before saving, the dialog shows how many of the rule's recent matches the exception would remove.
Suppressions
Add a suppression from an alert with Suppress… or from Settings › Suppressions. A suppression matches on entity and rule patterns and is checked before an alert is written, so suppressed matches never reach the queue and never start an SLA clock. Every suppression records why it exists and counts the alerts it has held back. A suppression with a large count on a critical rule is worth a second look.
Reviewing
Review both lists monthly: remove what has expired, and question anything whose reason no longer reads well.