---
title: "Manage Suppressed Threats"
slug: "manage-suppressed-threats"
updated: 2026-09-09T16:09:40Z
published: 2026-09-09T16:09:40Z
canonical: "docs.redcanary.com/manage-suppressed-threats"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage Suppressed Threats

Customizations let you tailor how Zscaler MDR reviews “Suspicious Activity” threats, helping reduce false positives and irrelevant notifications. Use this page to view and get notified about suppressed alerts.

## Viewing Suppressed Threats

Suppressed threats are available in the Zscaler MDR portal, or via API (add `state=suppressed` to your `GET` request).

1. In your Zscaler MDR portal, go to the **Threats** page.
2. Click the filter icon. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/manage-suppressed-threats-1_03.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A03%3A35Z&se=2026-10-27T03%3A03%3A35Z&sr=c&sp=r&sig=11pOd5xgzdxvkAtxqTX3gZfYYoGtgcyiX3M0sflAjwo%3D)
3. From the State dropdown, select **Suppressed**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/manage-suppressed-threats-1_02.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A03%3A35Z&se=2026-10-27T03%3A03%3A35Z&sr=c&sp=r&sig=11pOd5xgzdxvkAtxqTX3gZfYYoGtgcyiX3M0sflAjwo%3D)
4. Click **Apply Filters**.
5. Click on a threat to see a detailed explanation from the Threat Review Agent, including a link to the applied customization.

> [!NOTE]
> Note
> 
> Reopening a suppressed threat does not add it to reports or statistics; it will remain excluded from reporting.

## Configuring Notifications for Suppressed Threats

Customizations are designed to reduce excessive notifications caused by false positives. However, if you would like to monitor the initial performance of your customizations, you can set up notifications using the Automation trigger “When a Threat is suppressed.” This trigger alerts you when a threat is suppressed prior to publication.

1. In your Zscaler MDR portal, go to **Automations** and click **Configure New Trigger**.
2. Select **When a Threat is suppressed**.
3. Click **Connect Playbook** next the trigger you created.
4. Click **Add Action** and configure your preferred notification method.
5. Click **Save**.