In which two places can thresholding settings be configured? (Choose two.)

Thresholding settings in Cisco Firepower are used to control the rate at which events are generated, preventing event floods from noisy rules or detecting rate-based attacks. These settings can be configured in two distinct locations:
1. On each IPS rule: Within an intrusion policy, you can configure a threshold for a specific Snort rule. This limits the number of events logged for that rule over a specific time period, which is useful for tuning rules that may generate excessive false positives.
2. Per preprocessor, within the network analysis policy: The Network Analysis Policy (NAP) contains settings for rate-based attack prevention. This feature, managed by preprocessors, acts as a thresholding mechanism to detect and block anomalous traffic patterns, such as a host initiating too many connections, which could indicate a scan or a worm.

B. Thresholding is not a single global setting within the network analysis policy; it is configured on specific preprocessors within that policy.
C. Thresholding is a granular setting applied to individual rules within an intrusion policy, not as a single global setting for the entire policy.
D. Access control rules determine traffic handling (allow, block, inspect), while thresholding is a parameter of the intrusion inspection process itself.

1. Cisco Secure Firewall Management Center Snort 3 Configuration Guide

7.2

"Intrusion Rules" chapter

"Thresholding Intrusion Events" section.

This section states

"You can set a threshold on an intrusion rule to control the number of events that the rule generates in a specified time interval. For example

you can configure a rule to generate only one event when a specific type of attack is detected 100 times in one minute." This directly supports option A.

2. Cisco Secure Firewall Management Center Snort 3 Configuration Guide

7.2

"Network Analysis Policies" chapter

"Rate-Based Attack Prevention" section.

This section explains

"Rate-based attack prevention is a network analysis policy (NAP) feature that allows you to configure the system to take action on traffic that exceeds a defined rate." It further details that this is configured for specific preprocessors (Host

Responder

All). This directly supports option E.

3. Cisco Firepower Management Center Configuration Guide

Version 6.4

"Intrusion Policy Settings" chapter

"Rule Thresholding" section.

This document states

"You can set a threshold on an intrusion rule to control the number of events that the rule generates in a specified time interval." This provides further evidence for option A.

4. Cisco Firepower Management Center Configuration Guide

Version 6.4

"Network Analysis and Intrusion Policies" chapter

"Configuring Rate-Based Attack Prevention" section.

This guide states

"You can configure the system to apply rate-based prevention

which allows you to configure the system to take action on traffic that exceeds a defined rate... You configure rate-based attack prevention as part of a network analysis policy." This confirms that a form of thresholding is configured within the NAP

specifically on its preprocessor components

supporting option E.