How does raising an IDS signature's rate threshold differ from suppressing it, and which still records an intruder?

## Two constructs, one stage Both of these are output-stage controls on an intrusion sensor. The engine has already matched the traffic; the question is what gets emitted. - A **suppression** is unconditional for its scope: this signature, from or to these addresses, produces no event. Ever. - A **rate threshold** is conditional: emit at most N events for this signature per tracking key per time interval (or, in the other common shape, emit only after N have accumulated). The difference that matters in an interview is what survives for later. A threshold leaves a sample in the data. A suppression leaves an absence, and an absence is unfalsifiable — you cannot go back through the records and ask what you missed, because there are no records to ask. ## Why the tracking key is the real answer Candidates often stop at "a threshold is safer than a suppression". It usually is, and it stops being true the moment the tracking key is wrong. The key decides who consumes the allowance: | Tracked by | Who spends the budget | What happens to an intruder | | --- | --- | --- | | source address | each source, separately | their own events still emit | | destination address | whoever hits that target most | crowded out at a busy target | | signature, globally | the loudest talker on the sensor | crowded out estate-wide | So a well-meaning "limit this scan signature to ten alerts a minute", tracked globally, hands the entire allowance to the Sunday scanner walking the campus. Everything else that matches the same signature during those minutes — including someone quietly sweeping a wiring closet from a lecture-theatre socket — falls outside the ten and is never written. The threshold has become a suppression with extra steps, and it looks healthy because alerts are still arriving. A threshold tracked by source has the opposite and much better property: the noisy host burns its own budget and nobody else's. ## Pacing: what an adversary learns from a threshold A threshold expressed as "alert only after N events in T seconds" is a published speed limit. Anyone doing fewer than N in T is invisible by design, and reconnaissance is exactly the activity that tolerates being slow. This is not an argument against thresholds — it is an argument for knowing which shape you deployed. "At most N" keeps the first events and loses the tail; "only after N" loses the beginning, which is the part you would have wanted. ## Dedup is not tuning Sensors also collapse repeated identical events by generator and signature identifier so a single match is not written a thousand times. That is housekeeping and it preserves the fact that the match occurred. It is worth separating from a threshold in your answer, because conflating the two is how people convince themselves a suppression is "just deduplication". ## The in-path wrinkle Once the sensor is inline, silencing output and changing enforcement are different knobs. If you suppress a signature that also acts on packets, you can end up in the worst state available: traffic still being dropped, nothing at all recorded, and a help-desk ticket as your first indication that a business flow died. Before you silence anything on an inline device, establish whether the signature acts, and if it does, change the action deliberately rather than hiding its evidence. ## Choosing between them Reach for a threshold when the traffic is genuinely benign but voluminous and you still want to know it is happening. Reach for a suppression only when the events carry no information you would ever want — and even then, write the narrowest scope, name an owner, and set an expiry, because a suppression is the construct with no residue. In both cases the discipline is the same: the exception is a claim about the world, and claims need someone who will still defend them next year.