03 Tune risk detection

[ Applies to ] StorageGuard 9.2 and later  /  All supported storage, backup, SAN and cloud systems  /  Windows and Linux deployments

After your first analyses, some findings won't fit your environment: a check that doesn't apply, a threshold that's stricter than your standard, or a known exception you've accepted. Tune detection so findings reflect real risk, instead of teaching people to ignore them. StorageGuard gives you six ways to do it, each with a different reach.

Choose the right tool

If	Use	Effect
A check doesn't apply anywhere in your environment	Deactivate the check	The check stops running in every policy. It disappears from the Compliance tab, and all its findings close.
A check shouldn't raise findings for some systems, or for a while	Suppress the check	The check keeps running and stays on the Compliance tab. Its findings still open and close with the data, but carry a Suppressed status, for the scope you choose, indefinitely or until a date.
A check fails because your standard differs, such as a longer session timeout	Change a check parameter	Changes what counts as a pass, for every check that uses the parameter, globally or for chosen sites, policies or system types.
A check belongs in one policy but not another	Exclude it from the policy	Removes it from that policy only.
One finding on one system is an accepted exception	Suppress the finding	Hides that finding only.
A system's end of support date differs from the vendor's, for example under an extended support contract	Set an end of support date	End of support findings use your date.

Deactivate a check

1. Go to Baseline Configuration > Checks > Knowledge base.
2. Right-click the check and select Deactivate. The check shows a warning icon in the Active column.

From the next risk analysis, the check doesn't run as part of any policy, it no longer appears on the Compliance tab, and all its findings close.

To turn it back on, right-click it and select Activate. From the same menu, Show Details shows what the check tests, and Execute Test runs it on demand. Built-in checks are read-only; you can't edit or delete them.

Suppress a check

1. Go to Baseline Configuration > Risks, right-click a finding raised by the check, and select Check Tuning.
2. Under Suppression options, select Suppress all risks, or Suppress risks related to the following scope. For a scope, click Select items, choose the systems and click Save.
3. Under the expiration options, select Suppress indefinitely, or Suppress until and pick a date.
4. Select one or more reasons, and add Notes that explain the decision.
5. Click Apply.

A suppressed check still runs in every analysis and still appears on the Compliance tab, so you keep its pass and fail results as evidence. Its findings still open and close based on the data, but with a Suppressed status instead of appearing as open risks.

You can also suppress and unsuppress checks from the Knowledge base right-click menu, several at a time. To review or undo suppressions later, see Review suppressed checks.

Change a check parameter

Many checks rely on shared parameters, such as Account lockout threshold, Authorized syslog servers or Idle session timeout. Changing a parameter tunes every check that uses it, which is usually faster than tuning checks one by one.

1. Go to Baseline Configuration > Checks > Check Parameters. Or, from a finding's details, open the More menu next to the check name, select Edit Parameters and choose the parameter.
2. Find the parameter. Affected checks lists every check that will change.
3. In Default value, enter your value. It applies to all sites, policies and system types unless you add overrides.
4. To use a different value in some places, click +, enter the Value, and choose the Sites, Policies and System Types it applies to. Leave a field as All to apply everywhere. Click Apply, and repeat for more overrides.
5. Click Apply.

To use a value for a CI group, apply it through a policy: create a policy whose system scope includes the CI group, then add an override for that policy.

You can also import and export parameter values, for example to copy them between StorageGuard servers. The new values take effect in the next risk analysis.

Exclude a check from a policy

1. Go to Baseline Configuration > Settings > Policies and double-click your policy.
2. On the Analysis scope tab, add the check to Exclude checks. To exclude a group, use Exclude labels or Exclude check types.
3. Click Apply.

Suppress a single finding

1. Open the finding and change its status to Suppressed.
2. Select Suppress indefinitely, or Suppress until and pick a date.
3. In Notes, describe the exception, and click Apply.

Set an end of support date

End of support checks flag systems that have reached, or are approaching, their vendor's end of support date. If a system's real date is different, for example because you have an extended support agreement, override it with your own date.

1. Right-click the finding and select Set end of support date.
2. In End of support date, enter the date, or press Enter to open the calendar.
3. In Comment, record why the date differs, for example the support contract reference.
4. Click Apply.

To see and manage the dates you've set, see Review overridden end of support dates.

Review and audit tuning

Tuning decisions age. A suppression that made sense last quarter can hide a real risk today, and a changed parameter quietly changes what passes. Review them regularly, for example before an audit or after a major change.

Review suppressed checks

1. Go to Baseline Configuration > Checks > Tuning, and select the Checks tab. It lists every suppressed check.
2. Right-click a check and select Edit to change its scope, expiration date, reasons or notes, or Delete to remove the suppression so the check raises findings again.

Review suppressed findings

1. Go to Baseline Configuration > Risks, or Vulnerabilities > Risks for vulnerability findings.
2. In the filters bar on the left, turn on Show suppressed. Suppressed findings are marked with an icon.
3. To bring one back, right-click it and select Unsuppress, or change its status in the finding's details.

Each finding's Activity log records SUPPRESSED and UNSUPPRESSED events, so you can see when a finding was suppressed and whether it was later restored.

Review overridden end of support dates

Go to Baseline Configuration > Checks > Tuning, and select the End of support tab. It lists every system whose vendor end of support date you've overridden, and lets you manage the overrides.

Audit check parameter changes

A parameter change alters what passes for every check that uses it, so it's worth an audit trail. StorageGuard records these changes in the Event Log, under the Tuning category.

1. Go to Settings > Diagnostics > Logs > Event log.
2. Filter by the Tuning category.
3. Review the entries for changes to check parameters and their overrides.

For example:

Timestamp=Oct-05-2026 11:29:45
Message=Check parameter 'Approved ECDSA key size' was updated. New value: Default: 1024
Actor=JeffR
Source=192.168.33.17

Each entry shows when the change was made (Timestamp), which parameter changed and its new value, including whether it was the default or an override (Message), who made it (Actor), and the IP address it came from (Source). Entries show only the new value; to see the previous one, find the earlier entry for the same parameter.

For more on the Event Log, see StorageGuard Event Log Overview.

Related articles

• Run and schedule a risk analysis
• Choose and create baseline policies
• Create custom checks