diff --git a/docs/detections/alert-suppression.asciidoc b/docs/detections/alert-suppression.asciidoc index 21cac47320..4b8663be3f 100644 --- a/docs/detections/alert-suppression.asciidoc +++ b/docs/detections/alert-suppression.asciidoc @@ -71,6 +71,8 @@ image::images/alert-suppression-options.png[Alert suppression options,400] The {security-app} displays several indicators of whether a detection alert was created with alert suppression enabled, and how many duplicate alerts were suppressed. +IMPORTANT: After an alert is moved to the `Closed` status, it will no longer suppress new alerts. To prevent interruptions or unexpected changes in suppression, avoid closing alerts before the suppression interval ends. + * *Alerts* table — Icon in the *Rule* column. Hover to display the number of suppressed alerts: + [role="screenshot"]