Skip to main content
Solved

Clarification about suppression

  • April 15, 2026
  • 2 replies
  • 16 views

EP0
Forum|alt.badge.img+4

I would like to get some clarification on two things about suppression via options which are not clear based on the official documentation Options section syntax  |  Google Security Operations  |  Google Cloud Documentation

1.) For single event queries, is it possible to use more than one variable for the suppression key?  For example, $suppression_key = $hostname, $cmd does not work (editor throws an error), but using a strings.concat for the two variables does not throw an error

outcome:
$hostname = $e.principal.hostname
$user = $e.principal.user.userid
$cmd = $e.target.process.command_line
$suppression_key = strings.concat($hostname, $cmd)


2.) This statement from the doc If you don't specify a suppression_key, all query instances are suppressed globally during the window. What does this exactly mean, the entire rule is suppressed, regardless of what events are matched, during the specified window?

Best answer by cmorris

  1. Yes, strings.concat is what I use to suppress based on multiple keys.
  2. Yes - without a key, detections would be suppressed for the specified window after the initial detection.

2 replies

cmorris
Staff
Forum|alt.badge.img+12
  • Staff
  • Answer
  • April 15, 2026
  1. Yes, strings.concat is what I use to suppress based on multiple keys.
  2. Yes - without a key, detections would be suppressed for the specified window after the initial detection.

EP0
Forum|alt.badge.img+4
  • Author
  • Bronze 2
  • April 15, 2026
  1. Yes, strings.concat is what I use to suppress based on multiple keys.
  2. Yes - without a key, detections would be suppressed for the specified window after the initial detection.

Thanks a lot for the feedback, these are very good to know!