Alert suppression, snooze, or action-disable settings may be applied by a user with write access to alerting configuration while telemetry continues to be published. Alert conditions are still evaluated but no notification or action is delivered, so the activity that would have raised the alert proceeds undetected. This impacts the availability of security and operational information and delays incident response.
Alerts are Suppressed Without Expiry or Authorization
CCC.Monitor.TH08
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP17 | Alerting | The service may be configured to emit a notification based on a user-defined condition related to the data published by a child or networked resource. |
| CCC.Monitor.CP13 | Alert Suppression | The service may be configured to suppress or snooze alert notifications for a period of time or for matching conditions, so that alerts are not delivered during maintenance or known incidents. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.CN05 | Restrict Alert Suppression | Ensure that alerts cannot be silenced, snoozed, or disabled by users other than authorized responders, or for an unbounded period. |