Creating a suppression

Use the Create a Suppression dialog box to create a security message suppression.

You can suppress a security message in case of the following conditions:

You do not want to immediately correct the security condition that the security message reports.
You do not want ESM to report a particular security condition in your enterprise.

Symantec ESM does not figure the security score and level of suppressed security messages into the agent's total security score or level. Also, suppressions do not change the current report, but the future reports of the same policy.

A suppression becomes an attribute of the policy and does not affect policy runs using other policies. For example, a suppressed message on a Phase 1 report does not affect a Phase 2 policy run. The ESM console displays new suppressions under the policy node in the Enterprise tree.

To suppress a Security report item

Expand an agent from the summary branch, and select a policy run.
Select one or more messages in the grid.

To select adjacent rows, drag across the row numbers. You can also select the first row number, and press the Shift key on your keyboard while you select the last row.

To select non-adjacent rows, press the Ctrl key on your keyboard and select the required row numbers.

You can only select multiple rows using the column with the row numbers. You cannot use suppression wildcards when selecting multiple message rows.
Right-click a highlighted row, and then click Suppress.

The Create a Suppression dialog box provides several fields that you can use to set suppression options. The resulting suppression uses all of the criteria when matching messages from policy runs.
If you want to set the suppression criteria in a particular wildcard field, select the corresponding check box and edit the field.
In the Expiration Date text box, set the date on which the suppression expires. Select the part of the date you want to set and click the arrows to select the new date.

If you want the expiration to be permanent, select No Expiration.
Enter the reason for creating the suppression, or other helpful information about the suppression in the Comment field.

The suppression editor automatically lists the account that created the suppression, the date the suppression was made, and the date the suppression was used last.