ℹML rules suppress on anomaly result fields only. Source event fields aren't available for anomaly-based detections, and at most 3 fields can be selected.
Anomaly score threshold
75
Alerts are created when the anomaly score meets or exceeds this value. The score stays visible on every alert so analysts can judge how strong the deviation is.
Suppress alerts by2/3 fields
Enter up to 3 field names to group alerts by. Only anomaly result fields are available.