An exclusion without a review date is permanent
Every suppression was correct when it was written. Nothing connects it to the thing that justified it, so it outlives its reason quietly.
Every exclusion you have was correct when someone wrote it. That is why it is there.
The backup account really did generate four hundred alerts a day. The build agent really did look like credential dumping. Somebody investigated, understood it, and wrote a narrow exclusion so the rest of the rule could keep working. That is good engineering.
Then time passed. The backup account got repurposed. The build agent was decommissioned and its hostname reissued. The vendor path that was noisy in version 3 stopped being used in version 5. None of those changes produced a ticket to revisit an exclusion, because nothing connects a suppression to the thing that justified it.
So it stays, and what it covers slowly stops matching what it was written for. The failure is not that the exclusion becomes wrong. It is that it becomes wrong quietly, and nobody is looking.
Two fields fix most of this, and they are the two nobody adds: who put this here, and when should someone check it again. A date turns a permanent decision into a temporary one. It does not need to be a short date. Twelve months is fine. What matters is that a date exists at all, because a review that is never scheduled is a review that never happens.
Open your suppression list and count how many entries name a person and a date. That number is how much of it is still maintained.
CHECK YOURSELF
An exclusion added two years ago covers a hostname that has since been reassigned to a different server. What is the practical effect?
SHOW THE ANSWER
The exclusion suppresses alerts for a system nobody intended to exempt
Why. Exclusions match what you told them to match, and a reassigned hostname still matches the string. Nothing in the pipeline knows the machine behind the name changed, so the suppression quietly transfers to a system nobody ever assessed. That is why the useful metadata is not the exclusion's logic but its provenance: who decided this, against what, and when somebody should look again.