Noise Tuning and Silencing

Mute a noisy source

If a source is noisy or under maintenance, an admin can mute it from the Sources page in the portal. Muting suppresses that source’s alerts — its logs keep flowing in and stay searchable, so you don’t lose any history while it’s quiet. To stop ingestion entirely, ask the Hal team to disable the stream.

Tell Hal what’s normal

The most direct way to cut noise for a client is a note. You or your team can add short notes on a client — from the portal, or just by telling Hal in chat — describing what’s expected: a scanner that signs in nightly, an executive who travels to the EU, a service account on a fixed IP. Hal reads a client’s notes before he escalates, so a pattern you’ve marked as normal stops surfacing as an alert.

How the built-in filter is tuned

Ahead of all that, the first stage of triage is a blacklist that drops known-safe, high-volume events before they cost anything. That blacklist is maintained for you — if a benign pattern keeps surfacing across clients, ask Hal or reach out and it gets tuned. You never have to write or maintain detection rules yourself.