Multistage rules and alerting

A final key difference between single stage rules and multistage rules is that not all multistage rules should be configured to generate alerts. You should disable alerting on rules that are meant to detect the middle and final stages of an attack in your multistage rules. See Multistage rule workflow.

To disable a rule, see Enabling and disabling rules. To disable alerting for a rule, see Enabling and disabling rule alerting.