Suricata

Lots of the decode events can't currently be efficiently thresholded, as the decode event rules will not have IP addresses to track by. The only non-IP tracking that we currently support is a global "by_rule".

We need to inspect the various decode events to see what kind of thresholding would make most sense and then see how we can implement them.