Dear community,
We are expanding the suppression rule capabilities in Elements EDR to give you greater control over large, complex detections. With this update, you can now suppress key detections individually from BCD Details - directly from the Timeline, Process tree, or Process details views.
What is changing?
Previously, the Accepted Behavior closure wizard was limited to BCDs with up to five unsuppressed key detections. This limit exists intentionally to keep auto-generated rule sets small, precise, and easy to audit. Raising it could produce unwieldy or overly permissive rules.
With this update:
- For BCDs with more than five key detections, you can now suppress each remaining detection individually after closing the BCD as Accepted Behavior.
- A new per-detection suppression option is available directly in the BCD Details view (Timeline, Process tree, and Process details tabs) for all BCDs closed as Accepted Behavior.
Three-level organizational hierarchy
Suppression rules follow a three-level organizational hierarchy: Company, SEP (Service Partner), and SOP (Solution Provider). Each level can independently create its own suppression rule for the same key detection, with a maximum of one rule per level. A rule created at a given level can only be edited by administrators at that same level or above - when editing is not permitted at your level, the Edit button is disabled and a tooltip explains who can modify the rule.
What does this mean for you?
- For large BCDs with more than five key detections, you no longer need to work around the detection limit - you can suppress the remaining detections individually after closure.
- You retain full precision - each suppression rule is still tied to a specific key detection and pre-populated from its context, keeping rules targeted and auditable.
- The existing Accepted Behavior wizard for BCDs with five or fewer key detections is unchanged.
We believe this improvement will significantly enhance the day-to-day experience of security teams managing large, complex detections, and make the suppression workflow more flexible without compromising precision or auditability.