Overview — what it does
Administration ▸ Rules & Thresholds stores the hardcoded constants/global variables of the detection collectors srct_tx and kts_tx in infr_setting (group='rules'), read via App\Support\RulesPolicy (60s cache · DEFAULTS = original values).
Layout
A tab header + tab container (Suricata side / Kitsune side).
- srct — window · 5-heuristic thresholds · retention/cleanup · self-net · innocence-immunity days.
- kts — anomaly threshold · learning · block-confirm veto.
How to use
Adjust and save (audited); the values become the mashup source for the srct_tx/kts_tx code generation in Inventory ▸ Tools. fill(key) (Option B · admin · audited) merges RulesPolicy thresholds + legacy_glory DB credentials + WhitelistService::cidrList() (CDN) + ReputationProviderService::activeKeys() (AbuseIPDB, srct only) into the {{TOKEN}} placeholders.
Data sources
infr_setting(group='rules') ·App\Support\RulesPolicy(srctTokens()/ktsTokens())
Access
level≥10 (admin) self-gate + audit.
Related
