Rate-Based Attack Prevention, Detection Filtering, and Thresholding or Suppression
The
detection_filter keyword prevents a rule from
triggering until a threshold number of rule matches occur within a specified
time. When a rule includes the
detection_filter keyword, the system tracks the number
of incoming packets matching the pattern in the rule per timeout period. The
system can count hits for that rule from particular source or destination IP
addresses. After the rate exceeds the rate in the rule, event notification for
that rule begins.
You can use thresholding and suppression to reduce excessive events by limiting the number of event notifications for a rule, a source, or destination, or by suppressing notifications altogether for that rule. You can also configure a global rule threshold that applies to each rule that does not have an overriding specific threshold.
If you apply suppression to a rule, the system suppresses event notifications for that rule for all applicable IP addresses even if a rate-based action change occurs because of a policy-wide or rule-specific rate-based setting.