create_suppression_rule
Create a suppression rule to ignore a specific detection type and retroactively suppress past matching detections. Requires user confirmation after previewing expected impact via preview_suppression_rule.
Instructions
Create a suppression rule. WRITE OPERATION — requires confirm: true and a read-only API key will 403. Before calling this, you MUST call preview_suppression_rule with the same conditions and show the user the expected impact. Creating a rule also retroactively suppresses matching past detections (synchronous server-side). After creation the tool verifies how many past detections were moved. Severity action is hardcoded to 'ignore' (only type the backend supports).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| customer | No | StepSecurity customer/tenant identifier. Optional — falls back to STEP_SECURITY_CUSTOMER env var. | |
| detectionId | Yes | Detection type the rule targets, e.g. 'New-Outbound-Network-Call'. This becomes the rule's `id` field. | |
| name | Yes | Short human-readable rule name | |
| description | No | Longer rationale for the rule | |
| conditions | Yes | Match conditions. owner/repo/workflow/job are auto-filled with '*' if omitted. Include type-specific keys (endpoint, ip_address, process, host, file, file_path, secret_type, action) as needed. | |
| confirm | Yes | Set to true to actually execute the write. Any other value (including omitted) returns an error — this is a safety check so the LLM cannot write without explicit user approval. |