preview_suppression_rule
Preview suppression rule impact: fetches recent detections, filters by proposed conditions, returns count and up to 20 sample alerts with dashboard URLs. Use before creating a rule to verify effectiveness.
Instructions
APPROXIMATE client-side preview of what creating a suppression rule would do. Fetches recent detections of the given detection_id and filters them against the proposed conditions, returning the count and up to 20 samples (with dashboard_url per sample). Use this BEFORE create_suppression_rule to show the user concrete impact. Preview uses exact + wildcard matching — the server's matcher is stricter (CIDR for ip_address, regex), so the final count after create may differ slightly.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| customer | No | StepSecurity customer/tenant identifier. Optional — falls back to STEP_SECURITY_CUSTOMER env var. | |
| detectionId | Yes | Detection type the rule targets, e.g. 'New-Outbound-Network-Call', 'Secret-In-Build-Log', 'Action-Uses-Imposter-Commit' | |
| conditions | Yes | Match conditions. Keys: owner, repo, workflow, job (omit or '*' for wildcard), plus type-specific keys like endpoint, ip_address, process, host, file, file_path, secret_type, action. |