QUESTION

We frequently see the system alert "exceeded the 1 hour alert limit threshold of 1000", which automatically disables alert creation for the affected detection. Can we lower this threshold, and what are the recommended ways to manage noisy detections?

ANSWER

The hourly alert creation limit is a global setting that can be adjusted. To request a change, contact Panther Support with your desired threshold value. Note that the limit applies globally across all detections.

A few important considerations before requesting a change:

• A lower threshold may trigger more frequently, including during legitimate high-volume security events, which could suppress alerts you actually want to see.

• Once the limiter is triggered for a detection, re-enabling alert creation is manual and the "Create Alerts" option should be turned back on in the Panther console for that detection.

Recommended alternatives: tuning noisy detections

Rather than lowering the global threshold, Panther recommends addressing the root cause by tuning the noisy detections directly. This gives you more granular control without affecting all detections globally:

• Add inline filters to drop known-benign matches before they generate alerts (e.g. service accounts, internal IP ranges, known scanners, specific role patterns).

• Configure threshold and deduplication to group multiple matching events into a single alert rather than firing on every event individually.

• Split by severity, keep high-fidelity matches at the original severity and route lower-fidelity matches to INFO so they don't generate pages.