alert fatigue

DDoS Detection Thresholds: pps vs bps, Hysteresis, Tuning

How to set DDoS detection thresholds: pps vs bps, per-host vs per-prefix limits, hysteresis and hold timers, and tiered alerts that cut alert fatigue.