Suppress alert button in the web interterface

[jackface0]

Would it be possible to add a suppress button in the alerts tab in the web interface like we have for acknowledge and escalate. I'm not finding the acknowledge button too useful as the traffic will just return if its legitimate on going traffic. I think it would help speed up the time it takes to filter out the noise and start looking at real issues. Maybe change acknowledge so when the user clicks it we get the option to "acknowledge only" or to "acknowledge + suppress". Leave the more complicated suppressions/thresholding for CLI. This would just be a quick way to make broad strokes.

When you click the button it could give you some options.

• Supress on rule rule.uuid auto filled from the alert
• Suppress on source and destination IP auto filled from the alert
• Let the user add/edit source/destination IP in case more hosts/networks/any are needed to be added
• When user has defined what to suppress click "add" button

We would probably also need a suppressions page maybe under administration:

• view all current suppressions
• edit/disable/delete each created suppression
• maybe a quick checkbox to disable all suppressions for testing

Just an idea

[tiger-greenhell]

Great features

I vote for

But probably too complicated

[dougburks]

Yes, we have plans to build suppression into the web interface at some point in the future.