// Investigation
Tuning
Suppressions stop known-benign activity from raising alerts. This is the lever that keeps a detection library usable, and the one most capable of hiding a real intrusion, so every suppression records who created it and why.
2active0findings removed
Suppression rules
Applied during every sweep, before findings are written.
| On | Name | Field | Value | Justification | Removed | Created | Action |
|---|---|---|---|---|---|---|---|
| Backup agent file reads | username | svc_backup | Nightly backup service reads every share by design. Verified with infrastructure on 2026-08-14. — Zain Khan | 0 | |||
| Vulnerability scanner sweeps | sourceIp | 10.20.0.15 | Authorised internal scanner. Its denies are expected and were drowning the perimeter rule. — Analyst | 0 |