System Threshold exception BIOC rules

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

System Threshold exception BIOC rules

L1 Bithead

I have once upon a time set the system threshold exception to 100 hosts. So when the same BIOC is triggered on 100 hosts at the same time, it automatically creates an exception. I would like to raise the number of hosts, but I cannot find the place to change this setting. It is nowhere to be found. I seem to recall it being a setting in a menu once upon a time, but it is lost to me.

 

Does anyone know where i can find it?

 

DavidStevens_0-1684748059771.png

sorry about the small picture. It says Same process triggered Bioc 46 on 100 different hosts.

 

1 accepted solution

Accepted Solutions

L4 Transporter

Hi @DavidStevens 

 

Thank you for writing to live community!

 

If I understand correctly you may have configured this BIOC as a Custom Prevention Rule. If yes, then you may change the threshold in the Restriction Profile of your Assigned Prevention Policy on those endpoints for which BIOC alerts/incidents triggered.

 

 

Screenshot for reference:

PiyushKohli_0-1684749922981.png

 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

 

View solution in original post

2 REPLIES 2

L4 Transporter

Hi @DavidStevens 

 

Thank you for writing to live community!

 

If I understand correctly you may have configured this BIOC as a Custom Prevention Rule. If yes, then you may change the threshold in the Restriction Profile of your Assigned Prevention Policy on those endpoints for which BIOC alerts/incidents triggered.

 

 

Screenshot for reference:

PiyushKohli_0-1684749922981.png

 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

 

L1 Bithead

Hi,

 

Thank you so much for that! That was exactly what i was looking for. Couldn't find the answer with all the keywords i used.

  • 1 accepted solution
  • 1163 Views
  • 2 replies
  • 0 Likes
  • 78 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!