Issue
One or more threats show Suppressed by Threat Review Agent in the timeline and are in state:suppressed.
Environment
Red Canary Portal > Customizations
Resolution
Threat suppression is dictated by your Customizations. Review the suppressed threat, along with the Threat Review Agent analysis and proceed as follows.
- An undesired threat was appropriately suppressed: No further action is required.
-
A suppressed threat needs further investigation: Use the Re-open Threat button. Review your Explicit Instructions under Customizations to ensure similar threats are not suppressed in the future.
- Note: Re-opened threats will not trigger "When a Threat is published" automation conditions. See Playbook Did Not Run After Reopening a Suppressed Threat for details.
- The Threat Review Agent incorrectly suppressed a threat: If the suppression does not align with your Customizations, open a ticket with Red Canary Support.
Cause
When configured, Customizations are used by the Threat Review Agent input to suppress relevant “Suspicious Activity” threats. The Agent will explain suppression decisions and cite the specific Customization used.
For more information, see Customizations in the User Guide and our Red Canary blog post.