Suppression Rules

Suppression rules allow you to ignore specific outbound network calls from known domains that are not a security concern.

For example, if your organization regularly makes outbound calls to www.google.com, but these calls are being flagged as anomalous, you can create a suppression rule to prevent unnecessary alerts for this domain.

Scope of Suppression Rules

You can create suppression rules at different levels, depending on how broadly you want to apply them:

• Job Level – Applies to a specific job.
• Workflow Level – Applies to all jobs within a workflow.
• Repository Level – Applies to an entire repository.
• Organization Level – Applies across all repositories within the organization.

How to Create a Suppression Rule

There are two ways to create a suppression rule, from the:

• Suppression Rules page
• All Detections page

Method 1: From the Suppression Rules Page

Step 1: Navigate to Suppression Rules under the Harden Runner Section

Step 2: Click "Create rule"

Suppression Rules Page

Step 3: Enter the following details:

• Rule Name – Provide a meaningful name for the rule.
• Rule Type – Choose the appropriate rule type. The options shown will vary based on the detection type.
• Description – Add details about why this rule is being created.
• Destination – Specify the domain or IP Address to suppress (use * for wildcard matching).
• Process – Specify the exact process name. This allows you to suppress anomalous outbound calls originating from a specific process, even if other processes calling the same destination should still be monitored
• Scope – Choose the level of the rule: Job, Workflow, Repository, or Organization.

Step 4: Click "Save"

Method 2: Creating a Suppression Rule from the All Detections Page

Step 1: Navigate to Detections and go to the Anomalous Outbound Network Calls Tab

Step 2: Click on the three dots next to the detection you want to suppress and select "Suppress detection"

Step 3: A pop-up will appear asking why you want to suppress the detection. Select the appropriate reason, then click Suppress.

Viewing Applied Rules in Workflow Run Insights

Workflow run insights show which suppression rules were in effect for each job and what each rule suppressed. Previously, rules were applied silently: a suppressed detection simply did not appear, with no indication of which rule was responsible.

Suppression rules appear on three tabs of the workflow run insights page, matching the detection types they apply to:

• Network Events: rules based on network events, such as suppressions for anomalous endpoint detections on outbound calls.
• File Write Events: rules that apply to file write detections, such as source code overwrite detections.
• Controls: rules that apply to control detections, including secrets in build logs and secrets in artifacts.

To view the rules applied to a job:

1. Open the insights page for a workflow run and select the relevant tab.
2. Select a job in the job list. The job header shows a rules applied count alongside the job's metadata (Harden-Runner policy, runner name, and job labels).
3. Click View suppression rules to see the list of rules that applied to that job, with details of each rule and whether it suppressed anything in this run.

Suppression rules are scoped and applied at the job level, so different jobs in the same workflow run can have different rules in effect. One job may have several rules applied while another has none. A rule being applied to a job does not necessarily mean it suppressed a detection in that run; the rule details indicate whether it did.

This visibility makes it straightforward to audit why an expected detection does not appear in a run, and to verify that suppression rules are scoped the way you intend.