Feature Request: trigger suppresion on signal actions

Elastic Security SIEM
1

Hi,

Are we able to get a feature so that when a signal rul runs it only triggers the rule Actions if it has seen X hits in the last Y minuets. Is very helpfull for weeding out false posatives and I am having to do it externally currently.

Thanks in advance

2

I think you should put feature requests on github.

3

Hi @The1WhoPrtNocks!

This PR implemented your feature request.

Best,
Christos

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.