# How to use Alert Supression object in TOML format for threshold rules?
**URL:** https://discuss.elastic.co/t/how-to-use-alert-supression-object-in-toml-format-for-threshold-rules/372175
**Category:** Elastic Security
**Created:** [December 18, 2024, 4:37pm UTC](https://discuss.elastic.co/t/how-to-use-alert-supression-object-in-toml-format-for-threshold-rules/372175 "2024-12-18T16:37:04Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@obsidian](https://discuss.elastic.co/u/obsidian)
#### Post date: [December 18, 2024, 4:37pm UTC](https://discuss.elastic.co/t/how-to-use-alert-supression-object-in-toml-format-for-threshold-rules/372175/1 "2024-12-18T16:37:04Z")
I am trying to use the alert supression schema for a threshold rule but only the threshold field and value and cardinality field and value are showing up in elastic and not the alert supression, how do I add that into the toml file?
[rule.threshold]
field = ["field"]
value = 1
[[rule.threshold.cardinality]]
field = "field"
value = 250
> **[Create rule | Elastic Security Solution \[8.17\] | Elastic](https://www.elastic.co/guide/en/security/current/rules-api-create.html#alert-suppression-duration-schema)**
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 15, 2025, 4:37pm UTC](https://discuss.elastic.co/t/how-to-use-alert-supression-object-in-toml-format-for-threshold-rules/372175/2 "2025-01-15T16:37:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.