Does anyone know how long an alarm signature remains in quarantine after exceeding the threshold for storm protection?
Yes, I did. There is no specific duration; it is basically a sliding window. As far as I understand it, an alarm is evaluated for quarantine when it arrives at the NAS, and then the NAS looks back over the previous X minutes to determine if there are enough matching alarms to quarantine the current one.
Good question! Also interested.
Retrieving data ...