Baselines and suppressions 1.0

Baselines and suppressions

Last updated 10 Nov 2026
On this page

A baseline marks what your organisation runs on purpose; a suppression withholds a rule. Both keep a run honest about your environment - neither hides anything silently.

Baseline: approved, not hidden

JSON A baseline 
"baseline": [
  {"type": "service", "value": "BackupAgent", "context": "the backup product"},
  {"type": "file", "value": "C:\\Program Files\\Contoso\\*", "context": "Contoso's agents"},
  {"type": "hash", "value": "d41d8cd98f00b204e9800998ecf8427e"}
]

Build it once - your services, scheduled tasks, files, hashes, browser extensions, domains and accounts - and give it to every run. Types: file, sha256, sha1, md5 (or hash), service, task, extension, domain, account, matched as the pivot types are.

A signal whose subject or a named entity is in the baseline, or that carries one of its hashes, is kept and marked approved with the entry.

Approved remote access tools

Remote access products are approved with RemoteAccess's approved_tools parameter, not the baseline. RA-TOOL-PRESENT leaves out an approved product; every other RemoteAccess signal about it stays, marked approved.

JSON Approve one tenant of a tool 
"modules": {"RemoteAccess": {"approved_tools": ["TeamViewer@[email protected]"]}}

Suppress: withhold a rule

JSON Suppress a rule, with a reason 
"suppress": [
  {"rule": "EXEC-SUSPICIOUS-LOCATION", "reason": "the build team's tools run from ProgramData"}
]

  • Every suppression needs a reason.

  • The rule's outcome on the run is not_run, reason rule_excluded, with your reason in its text - never clear.

  • A suppressed ID that no module of the run has is warned about.

Which one to use

You want to say

Use

"This service is ours."

Baseline

"This remote tool, for our tenant, is approved."

approved_tools

"This rule is meaningless in our environment."

Suppress, with the reason

"This alert on this host was benign."

Neither: triage it in Signal Console

Next

Meet the modules.