Glossary: Security Monitoring and Automation

threshold rule

Also written: threshold, thresholds

A rule that alerts when something happens too often in a time window. brute-tuned.sql alerts at 8 or more failed sign-ins from one address in 10 minutes.