Suppress findings in Splunk Enterprise Security

Suppress findings to prevent excessive or unwanted numbers of findings from appearing on the analyst queue on the Mission Control page in Splunk Enterprise Security. Suppressing findings helps to reduce alert fatigue and focus on real threats by filtering out known safe or repetitive activity.

In Splunk Enterprise Security versions prior to 8.8, findings are suppressed based on an SPL suppression search filter that uses macros such as `get_notable_index`. The search data is evaluated against defined event types to categorize and tag the results and suppress findings. Any finding that matches the search conditions is not displayed on the analyst queue but is still added to the notable index.

Suppression is applied to events that are already in the notable index whereas throttling is applied to events before they are added to the notable index. A suppression filter hides findings so they are not displayed in the analyst queue whereas throttling prevents findings from being created.

In Splunk Enterprise Security version 8.8 and higher, suppression rules are based on KV store schema definitions. You must update KV store fields to handle suppression. You can tag findings and finding groups with a suppressed field to define whether it is visible or not in the analyst queue. You can also suppress or un-suppress multiple findings or finding groups manually in the analyst queue. You can also view all suppressed findings in the analyst queue.

Create suppressions for findings in Splunk Enterprise Security

Create suppressions for findings in Splunk Enterprise Security for version 8.8 and higher

When you upgrade to Splunk Enterprise Security version 8.8, legacy suppression rules can be converted to use the new KVStore suppression logic. However, some legacy compression rules must be recreated to suppress the required findings.
Note: When you upgrade to Splunk Enterprise Security version 8.8 or higher, the `get_notable_index` macro lets the suppression rule to be translated. Any other macro, operators such as OR or NOT, and wildcard characters can cause issues. You must update all macros other than the get_notable_index` macro in your legacy suppression rules. You must also expand the macros to ensure that suppression rules are converted to the new logic. Legacy suppression rules are re-translated with every rebuild of the suppression rules, usually every 5 minutes. Thus, you can expand or edit the macros after the upgrade. An untranslated suppression rule hides findings in the analyst queue at search time, but those findings still reach the mc_incidents search macro SOAR automation, and AI triage.
When you upgrade to Splunk Enterprise Security version 8.8 and higher, you cannot edit legacy suppression rules from prior versions as they are read-only. You must turn the suppression rules off and then recreate new suppression rules. You can recreate new suppression rules using the Suppression SPL from the View Suppressions page.
Note: A legacy suppression rule cannot be turned on after they are turned off.

To re-create suppressions for findings in Splunk Enterprise Security for version 8.8 and higher, you must identify the legacy suppression rules and then create new suppression rules.

Identify legacy suppression rules in Splunk Enterprise Security version 8.8 and higher

Follow these steps to identify legacy suppression rules:

  1. In Splunk Enterprise Security, go to Configure.
  2. Select Findings and investigations and then select Suppressions.
  3. View all the legacy suppression rules on the Suppressions page.
Note: All suppression rules created prior to Splunk Enterprise Security version 8.8 are labeled clearly as Legacy.

Create new suppression rules in Splunk Enterprise Security version 8.8 and higher

Follow these steps to create new suppression rules in Splunk Enterprise Security version 8.8 and higher:
  1. In Splunk Enterprise Security, go to Configure.
  2. Select Findings and investigations and then select Suppressions.
  3. Select +Suppression to create a new suppression rule.
  4. Enter a Name and Description for the suppression filter.
  5. Specify the field conditions using the comparison operator such as greater than, contains, is one of, is not one of, is, is not, greater than, less than, starts with, ends with, and contains. You can combine rows with the AND or OR operators.
  6. Set a Use start time. Findings before this time are not suppressed. The Use start time setting is optional. The start time must be now or later.
    Note: Only new findings can be suppressed. You cannot retroactively suppress findings that were created. Also, a finding matched by a legacy suppression rule can't be un-suppressed in the analyst queue. Also, investigations can't be suppressed.
  7. Set the Use expiration time. Findings after this time are not suppressed. The Use expiration time setting is optional.
  8. Select Save.

Suppress multiple findings manually in Splunk Enterprise Security version 8.8 and higher

Follow these steps to suppress multiple findings manually in Splunk Enterprise Security version 8.8 and higher:

  1. In Splunk Enterprise Security, go to the Analyst queue
  2. Select all the findings that you want to suppress from the analyst queue.
  3. Select Suppress to suppress multiple findings manually at the same time.
  4. To suppress findings individually, you can go to Actions drop-down and select Suppress. Alternatively, you can view the finding details on the side panel and select Suppress from the drop-down next to Run automation.

View all suppressed findings in the analyst queue in Splunk Enterprise Security version 8.8 and higher

Follow these steps to view suppressed findings in the analyst queue in Splunk Enterprise Security version 8.8 and higher:

  1. In Splunk ES, go to the Analyst queue.
  2. Go to View and select Suppressed to view all suppressed findings in the analyst queue.

Turn on or turn off suppressions for findings

Follow these steps to turn on or turn off the available suppressions in Splunk Enterprise Security:

  1. In Splunk Enterprise Security, select the Configure tab.
  2. Select Findings and investigations.
  3. Select Suppressions to view the list of available suppression rules. Suppression listings include the following information: Label, Description, Start time, Expiration time, and Status.
  4. Turn on or turn off specific suppression rules from this page.

Edit suppressions for findings

Follow these steps to edit the available suppressions in Splunk Enterprise Security:

Note: When you upgrade to Splunk Enterprise Security version 8.8 or higher, you can no longer edit legacy suppression rules. You must turn the suppression rules off and then recreate new suppression rules.
  1. In Splunk Enterprise Security, select the Configure tab.
  2. Select Findings and investigations.
  3. Select Suppressions to view the list of available suppression rules.
    Note: In Splunk Enterprise Security version 8.8 and higher, a legacy suppression rule opens a read-only View suppression modal that displays the SPL of the suppression rule.

Remove a suppression

Note: This topic applies if you want to unsuppress any legacy suppressed findings from Splunk Enterprise Security version 8.7.x.

Follow these steps to remove a suppression in Splunk Enterprise Security:

  1. From the Splunk platform toolbar, select Settings and then select Event types.
  2. Search for the suppression event. For example, notable_suppression-<suppression_name>.
  3. Select Delete in the Actions column for the suppression.

Audit, include, or exclude suppressed findings

Audit suppressions for findings using the Audit dashboard.

Exclude suppressed findings in the metrics displayed on the Executive summary dashboard and the SOC operations dashboard so that you can triage findings faster during an investigation. You also have the option to include findings in the metrics on the Executive summary dashboard and the SOC operations dashboard if you want to verify whether some findings were overlooked.

Follow these steps to include suppressed findings:

  1. In the Splunk Enterprise Security app, go to Analytics.
  2. Select the Executive summary dashboard or the SOC operations dashboard.
  3. Turn on Include suppressed findings to add suppressed findings on the dashboard metrics.

By default, Include suppressed findings is turned off.