Add event definition suppression status / setting

What?

Add a suppression feature for event definitions. This is similar to the notification grace period, but would prevent the suppressed generated events from being presented to users in Graylog's "Alerts & Events" view.

This will allow users to define a suppression period which will be applied after an event definition fires and generates an event - all subsequent finding with the same "key" fields will be suppressed until the configured suppression period lapses. This value should be configurable by the user in Illuminate-provided event definitions.

The events would still be generated and stored in the events index, but with a "suppressed" status.

It would be helpful to notify users that if no key fields are identified that all events for that event definition will be suppressed during the suppression period.

Why?

The goal of this is to aid with the reduction of alert noise. We configure event definition periods (how often an event definition search is run) primarily to consider the potential search load in a typical environment, but for high volume source events the potential exists for this to generate a high volume of generated events in the event stream, and for the customers to deal with.

Having a suppression period will assist users in dealing with noisy event definitions without introducing potential blind spots if we were to suppress event generation completely.

Your Environment

• Graylog Version:
• OpenSearch Version:
• MongoDB Version:
• Operating System:
• Browser version: