Skip to content

Commit d5f4c65

Browse files
marciocloudflaremarciocloudflare
committed
content
1 parent 325bab3 commit d5f4c65

File tree

2 files changed

+47
-35
lines changed

2 files changed

+47
-35
lines changed

‎src/content/docs/magic-network-monitoring/rules/dynamic-threshold.mdx‎

Lines changed: 8 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -7,39 +7,13 @@ sidebar:
77
text: Beta
88
---
99

10-
A dynamic threshold rule (beta) will analyze a network's traffic patterns over time and automatically adjust the rule's DDoS threshold, in terms of bits or packets, based on traffic history. The total traffic across all IP prefixes and IP addresses in the rule is compared to the current value of the dynamic threshold. If the total traffic exceeds the dynamic threshold, then an alert is sent.
10+
import { Render } from "~/components";
1111

12-
Dynamic thresholds are calculated using a statistical measure called [Z-score](https://en.wikipedia.org/wiki/Standard_score) (also referred to as standard score). Review [How the dynamic rule threshold is calculated](#how-the-dynamic-rule-threshold-is-calculated) to learn more.
12+
<Render
13+
file="mnm/rules/dynamic-threshold"
14+
product="networking-services"
15+
params={{
16+
productName: "Magic Network Monitoring",
17+
}}
1318

14-
Customers that send NetFlow and/or sFlow data to Cloudflare can configure dynamic threshold rules.
15-
16-
A dynamic threshold rule can only be configured via [Cloudflare's Magic Network Monitoring Rules API](/api/resources/magic_network_monitoring/subresources/rules/). Today, customers are unable to configure dynamic threshold rules in the Cloudflare dashboard.
17-
18-
## Rule configuration fields
19-
20-
| Field | Description |
21-
| :---- | :---- |
22-
| **Rule name** | Must be unique and cannot contain spaces. Supports characters `A-Z`, `a-z`, `0-9`, underscore (`_`), dash (`-`), period (`.`), and tilde (`~`). Maximum of 256 characters. |
23-
| **Rule type** | zscore |
24-
| **Target** | Can be defined in either bits per second or packets per second. |
25-
| **Sensitivity** | Z-Score sensitivity has three values: low, medium, and high. |
26-
| **Auto-advertisement** | If you are a [Magic Transit On Demand](/magic-transit/on-demand) customer, you can enable this feature to automatically enable Magic Transit if the rule's dynamic threshold is triggered. Magic Network Monitoring supports Magic Transit's supernet capability. To learn more refer to [Auto-Advertisement section](/magic-network-monitoring/rules/#rule-auto-advertisement). |
27-
| **Rule IP prefix** | The IP prefix associated with the rule for monitoring traffic volume. Must be a CIDR range such as `160.168.0.1/24`. The maximum is 5,000 unique CIDR entries. To learn more and review an example, refer to the [Rule IP prefixes](/magic-network-monitoring/rules/#rule-ip-prefixes). |
28-
29-
## API documentation
30-
31-
To review an example API configuration call using CURL and the expected output for a successful response, go to the [Rules](/api/resources/magic_network_monitoring/subresources/rules/) section in the Magic Network Monitoring API documentation.
32-
33-
## How the dynamic rule threshold is calculated
34-
35-
Dynamic thresholds for this rule type are calculated using a statistical measure called Z-Score. The dynamic threshold for this rule will automatically adjust based on your traffic history as this rule uses statistical analysis to detect traffic anomalies. Z-Score is calculated by comparing short-term traffic patterns (five-minute time window) against long-term baselines (four-hour time window) .
36-
37-
Z-Score is calculated by using the following formula:
38-
39-
```txt
40-
Z = (X - μ) / σ
41-
```
42-
43-
- `X` = Current traffic value.
44-
- `μ` = Mean traffic value over the long window.
45-
- `σ` = Standard deviation over the long window.
19+
/>

‎src/content/partials/networking-services/mnm/rules/dynamic-threshold.mdx‎

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,42 @@
11
---
22
params:
33
- productName
4-
---
4+
---
5+
6+
7+
A dynamic threshold rule (beta) will analyze a network's traffic patterns over time and automatically adjust the rule's DDoS threshold, in terms of bits or packets, based on traffic history. The total traffic across all IP prefixes and IP addresses in the rule is compared to the current value of the dynamic threshold. If the total traffic exceeds the dynamic threshold, then an alert is sent.
8+
9+
Dynamic thresholds are calculated using a statistical measure called [Z-score](https://en.wikipedia.org/wiki/Standard_score) (also referred to as standard score). Review [How the dynamic rule threshold is calculated](#how-the-dynamic-rule-threshold-is-calculated) to learn more.
10+
11+
Customers that send NetFlow and/or sFlow data to Cloudflare can configure dynamic threshold rules.
12+
13+
A dynamic threshold rule can only be configured via [Cloudflare's Magic Network Monitoring Rules API](/api/resources/magic_network_monitoring/subresources/rules/). Today, customers are unable to configure dynamic threshold rules in the Cloudflare dashboard.
14+
15+
## Rule configuration fields
16+
17+
| Field | Description |
18+
| :---- | :---- |
19+
| **Rule name** | Must be unique and cannot contain spaces. Supports characters `A-Z`, `a-z`, `0-9`, underscore (`_`), dash (`-`), period (`.`), and tilde (`~`). Maximum of 256 characters. |
20+
| **Rule type** | zscore |
21+
| **Target** | Can be defined in either bits per second or packets per second. |
22+
| **Sensitivity** | Z-Score sensitivity has three values: low, medium, and high. |
23+
| **Auto-advertisement** | If you are a [Magic Transit On Demand](/magic-transit/on-demand) customer, you can enable this feature to automatically enable Magic Transit if the rule's dynamic threshold is triggered. Magic Network Monitoring supports Magic Transit's supernet capability. To learn more refer to [Auto-Advertisement section](/magic-network-monitoring/rules/#rule-auto-advertisement). |
24+
| **Rule IP prefix** | The IP prefix associated with the rule for monitoring traffic volume. Must be a CIDR range such as `160.168.0.1/24`. The maximum is 5,000 unique CIDR entries. To learn more and review an example, refer to the [Rule IP prefixes](/magic-network-monitoring/rules/#rule-ip-prefixes). |
25+
26+
## API documentation
27+
28+
To review an example API configuration call using CURL and the expected output for a successful response, go to the [Rules](/api/resources/magic_network_monitoring/subresources/rules/) section in the Magic Network Monitoring API documentation.
29+
30+
## How the dynamic rule threshold is calculated
31+
32+
Dynamic thresholds for this rule type are calculated using a statistical measure called Z-Score. The dynamic threshold for this rule will automatically adjust based on your traffic history as this rule uses statistical analysis to detect traffic anomalies. Z-Score is calculated by comparing short-term traffic patterns (five-minute time window) against long-term baselines (four-hour time window) .
33+
34+
Z-Score is calculated by using the following formula:
35+
36+
```txt
37+
Z = (X - μ) / σ
38+
```
39+
40+
- `X` = Current traffic value.
41+
- `μ` = Mean traffic value over the long window.
42+
- `σ` = Standard deviation over the long window.

0 commit comments

Comments
 (0)