19.32 Event Suppression
Event Suppression enables the system to automatically suppress a particular entity’s newly generated alerts based on criteria such as scenario, suppression begin and end dates.
The rule captures information such as the creation date, the status, the generating scenario, the focal entity (focus type and focal entity ID) and the links to the comments by the user associated with the suppression.
Once a suppression rule is approved, the Behavior Detection (BD) engine will pull the rule into their tables via an API. The newly created alerts in BD that match the rule will be closed automatically based on the predefined BD algorithm. The ECM batch will move these alerts as events to ECM and then these events will be closed in batch.
The Suppression Administration page allows you to search for existing suppressions based on a set of user-specified parameters. The Manage Suppression Rules also enables you to modify certain components of rules, in particular, to update or to end an existing suppression rule as well as to track all actions performed on that rule.
Note:
Viewing account/customer details in the Suppression Administration UI are recorded in the fcc_generic_action_audit table.Configuring Suppression Actions
You can configure the options which display in the Take Action window in the Suppression Administration screen for each status by updating the fields V_ACTION_CD and V_FIELD_CD in the FCC_SUP_ACTION_FIELD_MAP table. The following table describes how to configure the suppression rule status to action mappings.
Table 19-25 Suppression Rule Status/Actions
| Table Name | Column Name | Description |
|---|---|---|
| FCC_SUP_STATUS | V_STATUS_CD | Status Code of Suppression rule. |
| FCC_SUP_STATUS | V_STATUS_NM | Status Name of Suppression rule |
| FCC_SUP_STATUS | F_ACTIVE_FL | Flag indicating whether or not the status is active. A value of “Y” indicates that the current status is active. A value of “N” indicates the current status is inactive. Only one status can have 'Y' for this column. |
| FCC_SUP_STATUS | F_SHARED_FL | A suppression rule status with value 'Y for this column will be part of the Suppression rule API response. |
| FCC_SUP_STATUS_TL | V_STATUS_CD | Status Code of Suppression rule. |
| FCC_SUP_STATUS_TL | V_STATUS_NM | Status Name of Suppression rule. |
| FCC_SUP_STATUS_TL | V_SOURCE_LOCALE | Source Locale in which the record was initially added. |
| FCC_SUP_STATUS_TL | V_LOCALE_CD | Locale Code of the Suppression rule. |
| FCC_SUP_STATUS_TL | V_CREATED_BY | Not in Use |
| FCC_SUP_STATUS_TL | D_CREATED_DT | Not in Use |
| FCC_SUP_ACTION | N_ACTION_ID | Action ID of Suppression rule. |
| FCC_SUP_ACTION | V_ACTION_CD | Action Code of Suppression rule. |
| FCC_SUP_ACTION | V_ACTION_NM | Action Name of Suppression rule. |
| FCC_SUP_ACTION | V_ACTION_DESC | Action Description of Suppression rule. |
| FCC_SUP_ACTION | F_START_ACTION | Action which is used to start the Suppression rule. A value of “Y” indicates this action is the starting action. Only one action can have 'Y' for this column. |
| FCC_SUP_ACTION | F_APPROVE_ACTION | Action which is used to approve the Suppression rule. A value of “Y” indicates this action is the approving action. Only one action can have 'Y' for this column. |
| FCC_SUP_ACTION | F_EXPIRE_ACTION | Action which is used to expire the Suppression rule. A value of “Y” indicates this action is the expiration action. Only one action can have 'Y' for this column. |
| FCC_SUP_ACTION_TL | N_ACTION_ID | Action ID of Suppression rule. |
| FCC_SUP_ACTION_TL | V_ACTION_CD | Action Code of Suppression rule. |
| FCC_SUP_ACTION_TL | V_ACTION_NM | Action Name of Suppression rule. |
| FCC_SUP_ACTION_TL | V_ACTION_DESC | Action Description of Suppression rule. |
| FCC_SUP_ACTION_TL | V_LOCALE_CD | Locale Code of the Suppression rule. |
| FCC_SUP_ACTION_TL | V_CREATED_BY | Not in Use |
| FCC_SUP_ACTION_TL | D_CREATED_DT | Not in Use |
Note:
Once expiration date is reached, you must set the Suppression records to expiry. Use the batch infodom_ECM_SUP_EXPIRY_BATCH for expiring Suppression records.Configuring Duration
The Duration drop-down list displays 3, 6, 9, and 12 month options by default. Configurable values will be done via a system parameter.
select * from KDD_CODE_SET_TRNLN
where
code_set='CMSUPDuration';
select * from KDD_CODE_SET_TRNLN_TL
where
code_set='CMSUPDuration';Note:
The CODE_VAL must be two digits. If the value is a single digit, prefix the month with 0. For example 03m,06m,09m. This will display the value in CODE_DISP_TX as 3 months, 6 months, and 9 months, respectively.