Hello! Thanks for answer. The main idea is to make the alert as soon as possible (in the first second), but not repeat again if the source IP and destination IP are repeated.
If I understood the documentation correctly, type ‘both’ work only if we don’t use threshold as a condition.
If I could separately set the thresholds for type ‘threshold’ and type ‘limit’ that would be great.