Rate-Based Attack Prevention Examples
The
detection_filter
keyword and the thresholding and suppression features provide other ways to
filter either the traffic itself or the events that the system generates. You
can use rate-based attack prevention alone or in any combination with
thresholding, suppression, or the
detection_filter
keyword.
The
detection_filter
keyword, thresholding or suppression, and rate-based criteria may all apply to
the same traffic. When you enable suppression for a rule, events are suppressed
for the specified IP addresses even if a rate-based change occurs.