Configure policy violation alert throttling for IPS devices

To manage alert noise, you can enable or disable the throttling of policy violation alerts for IPS devices. This helps you focus on high-priority alerts and make a decision whether NDR has to suppress or retains alerts based on the criticality of the target asset.

Enable/Disable alert throttling using CLI

Log into the NDR CLI using a terminal window or SSH client:
1. Using the SSH protocol, log into the appliance with management interface's IP address or hostname.
```
$ ssh npadmin@<NDR IP address>
```
2. Enter the password when prompted. The hostname > prompt is displayed after you have logged in.
Enter privileged mode on the NDR CLI.
```
npadmin@hostname> enable
```
Enter the npadmin password, when prompted. The password can be 5 to 24 characters long.
```
[sudo] password for npadmin: <password>
```
Enter configuration mode.
```
npadmin@hostname# configure system
```
The prompt changes to npadmin@hostname(config)# on the terminal indicating that the configuration mode is enabled.
Type policy-violation-alert-throttling at the terminal and press Enter.
The Configure policy violation alert throttling options are displayed.
Based on your needs, enable or disable throttling.
- If you enable throttling (default): All policy violation alerts gets suppressed for non-critical assets but continues to show up for critical assets. This is the recommended setting for reducing alert noise.
- If you disable throttling: All policy violation alerts from the IPS device is displayed, regardless of the target asset's criticality.
Type X to save the configuration and exit.