Manage Suppressed Threats

Customizations let you tailor how Red Canary reviews “Suspicious Activity” threats, helping reduce false positives and irrelevant notifications. Use this page to view and get notified about suppressed alerts.

Viewing Suppressed Threats

Suppressed threats are available in the Red Canary portal, or via API (add state=suppressed to your GET request).

1. In your Red Canary portal, go to the Threats page.

2. Click the filter icon.

3. From the State dropdown, select Suppressed.
   

4. Click Apply Filters.

5. Click on a threat to see a detailed explanation from the Threat Review Agent, including a link to the applied customization.

Note

Reopening a suppressed threat does not add it to reports or statistics; it will remain excluded from reporting.

Configuring Notifications for Suppressed Threats

Customizations are designed to reduce excessive notifications caused by false positives. However, if you would like to monitor the initial performance of your customizations, you can set up notifications using the Automation trigger “When a Threat is suppressed.” This trigger alerts you when a threat is suppressed prior to publication.

1. In your Red Canary portal, go to Automations and click Configure New Trigger.

2. Select When a Threat is suppressed.

3. Click Connect Playbook next the trigger you created.

4. Click Add Action and configure your preferred notification method.

5. Click Save.