Okay, first, your organization needs to figure out what automated system is hitting that account and get that turned off. Second, if you need a method to suppress alerts for this one account, you are going to have to modify the search/alert. I would suggest you create a lookup table, here called "SuppressAlerts.csv", with a field (here called USER) containing the userID in question. We're going to assume the username field in the event is UserName. At the end of your search, do this | lookup SuppressAlerts.csv USER as UserName OUTPUT USER as SuppressMe | where isnull(SuppressMe) That will kill the one alert in question. You will need to set up some organizational method of reviewing the SuppressAlerts.csv lookup periodically to see if the suppression is still valid. ... View more