# Alert Suppression

{% embed url="<https://www.youtube.com/watch?v=Uzu6Yk-VjSY>" %}

Alert Suppression can help you avoid alert fatigue by suppressing notifications for non-actionable alerts.

Squadcast will suppress the incidents that match any of the Suppression Rules you create for your Services. These incidents will go into the `Suppressed` state and you will not get any notifications for them.

These are useful in situations where you would like to *view* your all your informational alerts in Squadcast but do not want to get notified for them.

## Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* The User Role associated with the user in the Team must have required permissions to manage Services (ability to manage Suppression Rules).
* Integrate with an Alert Source and ensure that the Alert Source has started sending alerts to Squadcast before setting up Suppression Rules.

{% hint style="warning" %} <mark style="color:orange;">**Important:**</mark>\
Automation rule CRUD operations have a 5-minute caching delay before changes take effect.
{% endhint %}

## Create Alert Suppression Rules <a href="#creating-suppression-rules" id="creating-suppression-rules"></a>

1. Navigate to **Services** -> **Service Overview** -> select or search for your desired service.
2. In the extreme right, expand the accordion -> In Automation section, **View All**.
3. In the Suppression Rules section, **Add Suppression Rules**.
4. Select an **Alert Source** from the drop down -> **Add New Rule**.

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-d5bd2bf53ea51e8e0437781fef53967bec03b54f%2Falert_suppression_2_new.png?alt=media&#x26;token=7ec0a855-812f-4839-877c-eda3b88533c3" alt="how to create alert suppression rules in Squadcast" width="563"><figcaption></figcaption></figure>

5\. Suppression Rules can be added in two different ways:

### A. UI-based Rule Builder (Beginner-friendly) <a href="#a-ui-based-rule-builder-beginner-friendly" id="a-ui-based-rule-builder-beginner-friendly"></a>

1\. On the right, you can view the *payload of the **latest** alert* for the chosen Alert Source

2\. The drop-downs in the Rule Builder contain values from the payload on the right. You can use them to easily create your Suppression Rules. As you build the expression from these drop-downs, you can also see the corresponding *raw string* being auto-populated for the same under **String Expression**.

You can create Suppression Rules using the following conditions:

| Operators        | Condition                                                        |
| ---------------- | ---------------------------------------------------------------- |
| ==               | if the payload value is equal to the given value                 |
| !=               | if the payload value is not equal to the given value             |
| matches/contains | if the payload value matches (***or** contains*) the given value |
| does not contain | if the payload value does not contain the given value            |

{% hint style="warning" %}
**Note**: All these operators are case-sensitive.\
\
If you want to make the rules *case insensitive*, then you have to do it with the regular expression method.
{% endhint %}

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-76ddb0c199b916b5e8671f2f720f9ba06d16af41%2Falert_suppression_3_new.png?alt=media&#x26;token=5a69ac55-0177-49e3-a4a5-8e6b047feae6" alt="create your Alert Suppression Rules via UI-based Rule Builder in Squadcast" width="563"><figcaption></figcaption></figure>

3\. You can add more than 1 condition for a rule by selecting **Add Condition** (a logical AND is performed between all the conditions -> the entire Suppression Rule will evaluate to <mark style="color:red;">`True`</mark> only if all the conditions evaluate to <mark style="color:red;">`True`</mark>)

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-0fc2af9f0069025e9c3631c64cd6b7c623edfea1%2Falert_suppression_4_new.png?alt=media&#x26;token=0c1672b2-8da3-403f-8b88-f1570734f17f" alt="Adding more than one condition for Alert Suppression in Squadcast" width="563"><figcaption></figcaption></figure>

{% hint style="info" %} <mark style="color:blue;">**Note**</mark>**:**

The drop-down blocks only support the logical <mark style="color:red;">`AND`</mark> operator between 2 expressions. If you want to have a logical <mark style="color:red;">`OR`</mark> operation between 2 expressions, then you would have to create a new Suppression Rule.
{% endhint %}

{% hint style="info" %} <mark style="color:blue;">**Comparison Operators within Suppression Rules**</mark>

You can also leverage comparison operators such as <mark style="color:red;">`==, <, <=, >, >=`</mark> within your rules using the drop-down blocks, when the parameter you are evaluating against, is a **numerical value from the payload** to reduce alert noise.

<img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-5a71588e730515943ec222ef3d1b6278027259f7%2Falert_suppression_7_new.png?alt=media&#x26;token=8fd734c3-a906-482d-a590-688a2fd3cccb" alt="Alert Suppression Rules in Squadcast" data-size="original">
{% endhint %}

4\. You can suppress incidents based on time as well. To do so, check to **Suppress by time**. Add details for your suppression time slots like **Timezone**, **Duration** and **Repetition**.

Under **Duration**, you can specify **Start and End Dates** and choose **Start and End Time** as well or simply run it for the entire day.

You can add **Repetition** for your slot, to do so, you can choose from the **drop-down list**, while specifying the end for this repetition, as a particular date/time or never.

{% hint style="info" %}
**Note:** You can add multiple suppression time slots for a single Suppression Rule.
{% endhint %}

{% hint style="info" %}
**Note:** Users can select a timezone as per which the time slot needs to be active.
{% endhint %}

{% hint style="info" %}
**Note**: The search option under payload is not a free search, we have to search by JSON format, for example, type in payload.annotations to get annotations.

\
We also have an option for click-to search, wherein you can click on the keys in the payload to get their required values.
{% endhint %}

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-0de2c8d088ac972892a38f5dfaf1e08d05e86613%2Ftime-based_suppression.png?alt=media&#x26;token=76cbe396-1f08-49b9-93bd-fcd400ced9a4" alt="Set Alert Suppression based on time in Squadcast" width="563"><figcaption></figcaption></figure>

### B. Raw String Method <a href="#b-raw-string-method" id="b-raw-string-method"></a>

{% hint style="warning" %}
**Important**

Once you opt for the Raw String method, you cannot revert to the UI-based Rule Builder method.
{% endhint %}

(a) On the right, you can view the payload of the latest alert for the chosen Alert Source

(b) Click on **Edit** to enable **the** Raw String method

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-64fb4685353878c8af05c1916bfba705c7b72a67%2Falert_suppression_5_new.png?alt=media&#x26;token=26abf840-c0dd-40be-9cce-925b4d44eca0" alt="Edit Alert Suppression Rules in Squadcast" width="563"><figcaption></figcaption></figure>

(c) Write your custom Suppression Rule expression

{% hint style="info" %}
**How to make rules&#x20;*****case-insensitive*****?**\\

1. Click **Edit** -> **Proceed**
2. You will see the rule in the regular expression. Now you need to add the command lc (lower\_case) before the individual parameters

**Here is an example**:

`re(payload["subscription"]["type"], "Subscription")`

The rule says if the payload\["subscription"]\["type"]contains the string "Subscription" in it then do some actions.

\
If you want to make the above rule case insensitive, you have to add the command lc before the individual parameters.

\
The case insensitive rule would look like this,

`re(lc(payload["subscription"]["type"]), lc("Subscription")) or`

`re(lc(payload["subscription"]["type"]), "subscription")`
{% endhint %}

(d) You can suppress incidents based on time as well. To do so, check to **Suppress by time**. Add details for your suppression time slots like **Timezone**, **Duration** and **Repetition**.

Under **Duration**, you can specify **Start and End Dates** and choose **Start and End Time** as well or simply run it for the entire day.

You can add **Repetition** for your slot, to do so, you can choose from the **drop-down list**, while specifying the end for this repetition, as a particular date/time or never.

{% hint style="info" %}
**Note:** You can add multiple suppression time slots for a single Suppression Rule.
{% endhint %}

{% hint style="info" %}
**Note:** Users can select a timezone as per which the time slot needs to be active.
{% endhint %}

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-0de2c8d088ac972892a38f5dfaf1e08d05e86613%2Ftime-based_suppression.png?alt=media&#x26;token=76cbe396-1f08-49b9-93bd-fcd400ced9a4" alt="custom Alert Suppression Rule expression raw string method in Squadcast" width="563"><figcaption></figcaption></figure>

### Supported Rules <a href="#supported-rules" id="supported-rules"></a>

The rule engine supports expressions with parameters, arithmetic, logical, and string operations. You can also check out this [<mark style="color:blue;">link</mark>](https://regex101.com/) to get an idea of all the expression types accepted in Squadcast.

#### **Basic Expressions**

<mark style="color:red;">`10 > 0`</mark>, <mark style="color:red;">`1+2`</mark>, <mark style="color:red;">`100/3`</mark>

#### **Parameterized Expressions**

<mark style="color:red;">`payload.metric == "disk"`</mark> The available parameters are <mark style="color:red;">`payload`</mark>: This parameter contains the JSON payload of an incident which will be the same as the JSON payload format for the future events for a particular alert source <mark style="color:red;">`payload`</mark>: This parameter contains the JSON payload of an incident which will be the same as the JSON payload format for the future events for a particular alert source <mark style="color:red;">`payload`</mark>: This parameter contains the JSON payload of an incident which will be the same as the JSON payload format for the future events for a particular alert source <mark style="color:red;">`incident_details`</mark>: This contains the content of the <mark style="color:red;">`message`</mark> and <mark style="color:red;">`description`</mark> of the incoming event <mark style="color:red;">`source`</mark>: This denotes the associated alert source for the current/incoming event

#### **Regular Expressions**

<mark style="color:red;">`re(payload.metric, "disk.*")`</mark>

#### **Parse JSON content within the payload using `jsonPath` to add a tag**

#### **General Format** <mark style="color:red;">`jsonPath(<the JSON string that should be parsed for JSON content>, <"the parameter that needs to be picked from the parsed JSON object">)`</mark>

#### **Example**

Below is an example payload:

```
{
	"payload": {
   "payload": {
	"payload": {
		"Type": "Notification",
		"MessageId": "5966c484-5b37-58df",
		"TopicArn": "arn:aws:sns:us-east-1:51:Test",
		"Message": "{\"AlarmName\":\"Squadcast Testing - Ignore\",\"AlarmDescription\":\"Created from EC2 Console\"}"
	}
}
```

```
jsonPath(payload.Message, "AlarmName");
```

This will pick out the value <mark style="color:red;">`AlarmName`</mark> from the Message object in the payload based on which, you can suppress the incident.

#### **Example**

{% hint style="info" %}
**Multiple Alert Sources**

We can see alert payloads of past events from different alert sources for the service by selecting the respective alert source from the dropdown on the right-half side.

Since the payload format is fixed for a given alert source, it is usually preferable to have suppression rules on a per-alert source basis. This can be done by making use of the `source` field which lets you know the alert source that triggered the incoming event.

For example, if you want to have a suppression rule for a service, only for alerts coming from **`grafana`** alert source, then the corresponding rule would look something like this:

```
source == 'grafana' && (<your_suppression_rule>)
```

{% endhint %}

Below is an example payload for demonstration:

```
{
	"payload": {
		"issue_description": "bug - 2",
		"issue_id": "10029",
		"issue_key": "HYD-30",
		"issue_labels": [],
		"issue_link": "http://13.233.254.18:8080/browse/HYD/issues/HYD-30",
		"issue_priority": "Medium",
		"issue_summary": "bug - 2",
		"issue_type": "Bug",
		"project_id": "10000",
		"project_key": "HYD",
		"project_name": "hydra"
	},
	"incident_details": {
		"message": "[Bug] bug - 2",
		"description": "+ Project: HYDRA \n+Issue Type: Bug ..."
	},
	"source": "grafana"
}
```

To suppress any incoming alert when:

* The alert message contains: <mark style="color:red;">`[Bug]`</mark>
* The alert source is <mark style="color:red;">`grafana`</mark>

**Suppression Rule:**

```
re(payload.incident_details.message, "[Bug]") && source == "grafana";
```

## Discarding suppressed incidents <a href="#discarding-suppressed-incidents" id="discarding-suppressed-incidents"></a>

To discard incoming alerts and stop them from being triggered as incidents in Squadcast, use the <mark style="color:red;">`discard()`</mark> function in conjunction with Suppression Rules.

### Example <a href="#example-1" id="example-1"></a>

Suppression Rule:

```
source == "grafana" && re(payload["message"], "Notification Message");
```

Suppression Rule with <mark style="color:red;">`discard()`</mark>:

```
source == grafana &&
	re(payload["message"], "Notification Message") &&
	discard();
```

{% hint style="info" %}
**Avoid hitting Rate Limits**

The `discard()` function can be used to avoid hitting the [<mark style="color:blue;">**Incident Rate Limits**</mark>](https://support.squadcast.com/docs/incident-rate-limiting) as **Suppressed events that are discarded** don’t get counted against the allowed rate limits.
{% endhint %}

## Viewing Suppressed Incidents <a href="#viewing-suppressed-incidents" id="viewing-suppressed-incidents"></a>

You can view <mark style="color:red;">`suppressed`</mark> incidents on the[ <mark style="color:blue;">Incidents</mark>](https://support.squadcast.com/incident-list/incident-list-view) page by clicking on **All Incidents** and choosing **Suppressed** as highlighted in the screenshot below.

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-48303418e427a3a41f7276a3e22362978dc82a09%2Falert_suppression_6_new.png?alt=media" alt="how to view Suppressed Incidents in Squadcast" width="563"><figcaption></figcaption></figure>

{% hint style="info" %}
**Note**

* **`Suppressed`** and **`Resolved`** are the final states for incidents in Squadcast. You will not be able to take any action on incidents that are in these states.
* Incident information will be available on the Squadcast platform even if they are suppressed.
  {% endhint %}

## FAQs <a href="#faqs" id="faqs"></a>

1\. What kind of regex can be used to write custom rules?

The rule engine supports expressions with parameters, arithmetic, logical, and string operations. You can also check [<mark style="color:blue;">this</mark>](https://regex101.com/) out to get an idea of all the expression types accepted in Squadcast. Please do your regex [<mark style="color:blue;">here</mark>](https://regex101.com/) against <mark style="color:red;">`Golang`</mark> flavour as shown in the screenshot below and then, set them up in Squadcast:

![Regex used to write custom rules](https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-0a3de1a55aed181cdc4610c563ed06abd5bdb64f%2Fgolang.png?alt=media)

2\. Can I create OR rules?

Yes, you can. The evaluation between different Suppression Rules is <mark style="color:red;">`OR`</mark>. Add multiple Suppression Rules to enable <mark style="color:red;">`OR`</mark> evaluation.

3\. While adding a Suppression Rule, is the *search string* in the rule case sensitive?

Yes, that is correct. For example, if your search string is “ALERT” and your payload does not contain “ALERT” but contains “Alert”, this will not be matched. Your search string should be “Alert”.

4\. How do I know if an incident gets suppressed due to a Suppression Rule?

In the Incident’s Activity Timeline, the reason for suppression is displayed.

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-2bbf217ccd4194ce062a786215321c44bb178639%2Fsuppression_reason.png?alt=media&#x26;token=23882797-6a8b-49aa-b998-08b9ca3bdaf2" alt="Alert Suppression notification in the Incident Activity Timeline" width="563"><figcaption></figcaption></figure>

5\. I have configured multiple rules for a particular Service. Can I search through the configured rules to find the rule I am looking for?

Yes, that is doable. You will notice a **Search** option on the left top of the rules modal. You can type in a word you recall from the rule description or the rule itself. Any matching results will yield a narrowed-down set of rules.

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-4137bbdb27e2827d48e91a5cebb3c0090ff3fce0%2Fautomation-rules-search-1%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(11).png?alt=media&#x26;token=0acda9ca-9f6b-4c20-9d3b-ea8cdace5e62" alt="Search through configured Alert Suppression Rules" width="190"><figcaption></figcaption></figure>

*Have any questions?* [*Ask the community*](https://community.squadcast.com/view/home)*.*