QUESTION

Does Panther support suppressing or ignoring policy alerts at the cloud account level (rather than per-resource)?

ANSWER

Panther does not currently support native account-level policy suppression. If you are interested in support of this feature, please contact Panther Support to put in a request.

As a workaround, you can use one of the following approaches to reduce alert noise from non-production or otherwise non-actionable accounts:

1. Exclude resources via regex at the Cloud Account level: You can configure a resource regex exclusion list on a per-account basis. Resources matching the pattern will be excluded from cloud scanning entirely, no policies will run against them and no alerts will be generated. To set this up, navigate to Cloud Accounts > select your non-prod account > Advanced Options > Exclude Resources by Regex > Add Regex, add your regex exclusion list, and click Save. This is the recommended approach as it most directly addresses account-level suppression.

2. Dynamic severity override per policy: If you prefer to keep scanning non-prod resources but reduce noise, you can add a severity(resource) function to each policy that downgrades the alert severity when resource.get('AccountId') matches your non-prod accounts. This requires modifying each policy individually but provides finer-grained control over alert severity.