Suppression is a security decision
Muting an alert is a decision to stop looking at a category of thing, and it deserves the same scrutiny as a decision to start.
It usually happens informally, under pressure, to reduce noise, and then persists forever with no record of why. Suppressions need owners, reasons and expiry dates, because otherwise the accumulated set of things nobody sees becomes a map of where an attacker can operate unobserved.
More on Detection engineering
- A detection is a hypothesis encoded as logicA guess you can run
- High fidelity and high coverage pull in different directionsOne screen, one setting
- Detections inherit telemetry blind spotsThe hole is copied too
- Detection names should describe behaviour, not certaintyName the behaviour
- Detection rules need regression testsRun the old cases again
- Behaviour often outlives static indicatorsThe footprints, not the coat