DocsProtection

Detectors and Thresholds

Three levels per detector, with a time window each.

Level	Means
Warning	Unusual. Logged and shown.
Incident	Abuse. An incident opens and your rules can act.
Critical	Severe abuse. Your strongest rules apply.

Windows

Each level has a value and a time window, for example 100 targets over 10 minutes. A VM must hold above the value across the window.

In Custom Protection, add an override on a VM to change a detector for that VM only, for example a busy game server.

See Attack Types for every detector and its defaults.