# Alert Suppression on Event Correlation Rule (duplicate alerts)

**URL:** https://discuss.elastic.co/t/alert-suppression-on-event-correlation-rule-duplicate-alerts/338837
**Category:** Elastic Security
**Tags:** detection-rules
**Created:** [July 20, 2023, 1:02am UTC](https://discuss.elastic.co/t/alert-suppression-on-event-correlation-rule-duplicate-alerts/338837 "2023-07-20T01:02:22Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![adub08](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adub08/32/123023_2.png) [@adub08](https://discuss.elastic.co/u/adub08)
#### Post date: [July 20, 2023, 1:02am UTC](https://discuss.elastic.co/t/alert-suppression-on-event-correlation-rule-duplicate-alerts/338837/1 "2023-07-20T01:02:22Z")

</div>

Has anyone found a good way of modifying the prebuilt in event coloration rules Elastic Security to not produce too many alerts repeated alerts within a short time span? Similar to how Alert suppression works with custom query detection rules. For example I have the "Multiple Logon Failure from the same Source Address" rule produce 30 alerts from events that all occur within 2min. Just wondering if anyone has any work arounds for this?  
Thanks

---

<div class="post-metadata">

### Author: ![Pedro\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pedro_jaramillo/32/45904_2.png) [@Pedro\_Jaramillo](https://discuss.elastic.co/u/Pedro_Jaramillo)
#### Post date: [July 24, 2023, 3:30pm UTC](https://discuss.elastic.co/t/alert-suppression-on-event-correlation-rule-duplicate-alerts/338837/2 "2023-07-24T15:30:27Z")

</div>

Hi @adub08, unfortunately we don't currently support alert suppression on Event Correlation rules, but we hope to add this functionality in the future. In the meantime, you could at least visually reduce the number of alerts displayed on the Alerts page by leveraging features like [Alert Grouping](https://www.elastic.co/guide/en/security/current/alerts-ui-manage.html#group-alerts).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 21, 2023, 3:30pm UTC](https://discuss.elastic.co/t/alert-suppression-on-event-correlation-rule-duplicate-alerts/338837/3 "2023-08-21T15:30:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.