Actions
Feature #7120
closedthreshold: add backoff type
Effort:
Difficulty:
Label:
Description
Implement new `type backoff` for thresholding. This allows alerts to be limited. This is meant to control output of potentially extremely verbose rules like stream rules, decoder events, etc.
A count of 1 with a multiplier of 10 would generate alerts for matching packets: 1, 10, 100, 1000, 10000, 100000, etc.
A count of 1 with a multiplier of 2would generate alerts for matching packets: 1, 2, 4, 8, 16, 32, etc.
Like with other thresholds, rule actions like drop and setting of flowbits will still be performed for each matching packet.
Updated by Victor Julien 3 months ago
- Blocked by Feature #6822: threshold: support tracking by flow added
Updated by Victor Julien 3 months ago
- Status changed from In Progress to In Review
Updated by Victor Julien 2 months ago
- Status changed from In Review to Closed
Actions