Glossary: Hardening, Firewalls and Intrusion Detection

Threshold

Also written: threshold rule

An alert rule type that fires when a count passes a limit, such as 10 failed logins in 5 minutes; a threshold of 1 fires on a single event, such as any touch on a decoy. The other two rule types are change rules (something important changed) and anomaly rules (something differs from the baseline).