How to suppress an alert and create a new suppression rule

Whenever an alert continuously comes into your queue that you have verified is either a false positive or a genuine business process, here are the steps you will take to either suppress the alert or create a suppression rule:

1. Select the alert you would like to suppress; upon doing so, you will be greeted with the alert management pane.
2. Select Create a suppression rule:

Figure 6.5 – Creating a suppression rule

You will be able to create a suppression condition that matches the alert fired. An AND operator is applied to each condition, so think of it as this AND this must exist in order for it to match the rule, and therefore be suppressed.

Here is a list of the conditions you can choose from:

• SHA1 file.
• IP address.
• Filename – wildcard supported.
• URL – wildcard supported.
• Folder path – wildcard supported.
• Command line –...