> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/github-actions/harden-runner/suppression-rules.md).
# Suppression Rules
Suppression rules allow you to ignore specific outbound network calls from known domains that are not a security concern.
For example, if your organization regularly makes outbound calls to `www.google.com`, but these calls are being flagged as anomalous, you can create a suppression rule to prevent unnecessary alerts for this domain.
## Scope of Suppression Rules
You can create suppression rules at different levels, depending on how broadly you want to apply them:
* Job Level – Applies to a specific job.
* Workflow Level – Applies to all jobs within a workflow.
* Repository Level – Applies to an entire repository.
* Organization Level – Applies across all repositories within the organization.
### How to Create a Suppression Rule
There are two ways to create a suppression rule, from the:
* Suppression Rules page
* All Detections page
### Method 1: From the Suppression Rules Page
**Step 1:** Navigate to `Suppression Rules` under the Harden Runner Section
**Step 2:** Click "Create rule"
**Step 3:** Enter the following details:
* Rule Name – Provide a meaningful name for the rule.
* Rule Type – Choose the appropriate rule type. The options shown will vary based on the [detection type](/workspace/detections.md#types-of-detections).
* Description – Add details about why this rule is being created.
* Destination – Specify the domain or IP Address to suppress (use \* for wildcard matching).
* Process – Specify the exact process name. This allows you to suppress anomalous outbound calls originating from a specific process, even if other processes calling the same destination should still be monitored
* Scope – Choose the level of the rule: Job, Workflow, Repository, or Organization.
**Step 4:** Click "Save"
### Method 2: Creating a Suppression Rule from the All Detections Page
**Step 1:** Navigate to `Detections` and go to the Anomalous Outbound Network Calls Tab
**Step 2:** Click on the three dots next to the detection you want to suppress and select "Suppress detection"
**Step 3:** A pop-up will appear asking why you want to suppress the detection. Select the appropriate reason, then click Suppress.
### Viewing Applied Rules in Workflow Run Insights
Workflow run insights show which suppression rules were in effect for each job and what each rule suppressed. Previously, rules were applied silently: a suppressed detection simply did not appear, with no indication of which rule was responsible.
Suppression rules appear on three tabs of the workflow run insights page, matching the detection types they apply to:
* **Network Events**: rules based on network events, such as suppressions for anomalous endpoint detections on outbound calls.
* **File Write Events**: rules that apply to file write detections, such as source code overwrite detections.
* **Controls**: rules that apply to control detections, including secrets in build logs and secrets in artifacts.
To view the rules applied to a job:
1. Open the insights page for a workflow run and select the relevant tab.
2. Select a job in the job list. The job header shows a **rules applied** count alongside the job's metadata (Harden-Runner policy, runner name, and job labels).
3. Click **View suppression rules** to see the list of rules that applied to that job, with details of each rule and whether it suppressed anything in this run.
Suppression rules are scoped and applied at the job level, so different jobs in the same workflow run can have different rules in effect. One job may have several rules applied while another has none. A rule being applied to a job does not necessarily mean it suppressed a detection in that run; the rule details indicate whether it did.
This visibility makes it straightforward to audit why an expected detection does not appear in a run, and to verify that suppression rules are scoped the way you intend.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.stepsecurity.io/github-actions/harden-runner/suppression-rules.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.