---
title: "Create a suppression rule"
method: POST
path: "/api/v2/security_monitoring/configuration/suppressions"
tags: ["Security Monitoring"]
---

# Create a suppression rule

`POST /api/v2/security_monitoring/configuration/suppressions`

Create a new suppression rule.

## Request body

- SecurityMonitoringSuppressionCreateRequest — Request object that includes the suppression rule that you would like to create.
  - `data` SecurityMonitoringSuppressionCreateData, required — Object for a single suppression rule.
    - `attributes` SecurityMonitoringSuppressionCreateAttributes, required — Object containing the attributes of the suppression rule to be created.
      - `data_exclusion_query` string — An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
      - `description` string — A description for the suppression rule.
      - `enabled` boolean, required — Whether the suppression rule is enabled.
      - `expiration_date` integer — A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
      - `name` string, required — The name of the suppression rule.
      - `rule_query` string, required — The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
      - `start_date` integer — A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
      - `suppression_query` string — The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
      - `tags` string[] — List of tags associated with the suppression rule.
    - `type` 'suppressions', required — The type of the resource. The value should always be `suppressions`.

## Response `200`

OK

- SecurityMonitoringSuppressionResponse — Response object containing a single suppression rule.
  - `data` SecurityMonitoringSuppression — The suppression rule's properties.
    - `attributes` SecurityMonitoringSuppressionAttributes — The attributes of the suppression rule.
      - `creation_date` integer — A Unix millisecond timestamp given the creation date of the suppression rule.
      - `creator` SecurityMonitoringUser — A user.
        - `handle` string — The handle of the user.
        - `name` string, nullable — The name of the user.
      - `data_exclusion_query` string — An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
      - `description` string — A description for the suppression rule.
      - `editable` boolean — Whether the suppression rule is editable.
      - `enabled` boolean — Whether the suppression rule is enabled.
      - `expiration_date` integer — A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
      - `name` string — The name of the suppression rule.
      - `rule_query` string — The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
      - `start_date` integer — A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
      - `suppression_query` string — The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
      - `tags` string[] — List of tags associated with the suppression rule.
      - `update_date` integer — A Unix millisecond timestamp given the update date of the suppression rule.
      - `updater` SecurityMonitoringUser — A user.
        - `handle` string — The handle of the user.
        - `name` string, nullable — The name of the user.
      - `version` integer — The version of the suppression rule; it starts at 1, and is incremented at each update.
    - `id` string — The ID of the suppression rule.
    - `type` 'suppressions' — The type of the resource. The value should always be `suppressions`.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `409` — Conflict
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)