cschantz 7e5a09bf6b CRITICAL FIX: Lower Tier 0 baseline threshold from 20 to 3 for proper detection ...

With 8-41 SYN connections, IPs are distributed and typically have 3-7 connections each.
Previous threshold of 20 prevented all detection.
New threshold of 3 allows detection of even minor threats.

This allows detection patterns like:
- 40 connections across 8 IPs (5 each) → all 8 detected
- 40 connections across 10 IPs (4 each) → all 10 detected
- 40 connections across 20 IPs (2 each) → none detected (2 < 3)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

2026-03-06 23:00:56 -05:00

..

backup

FIX: Remove unnecessary press_enter after step 5 dump failure

2026-02-27 21:56:26 -05:00

diagnostics

Fix AWK-UNINIT issues by initializing variables in BEGIN blocks

2026-02-07 02:49:57 -05:00

email

Standardize mail-log-analyzer.sh menu validation and colors

2026-02-17 18:41:11 -05:00

maintenance

Fix HIGH priority issues: paths, globs, deps, wordsplit

2026-01-02 17:21:19 -05:00

performance

Fix batch analyzer to flag domains needing optimization increases

2026-02-19 00:05:07 -05:00

security

CRITICAL FIX: Lower Tier 0 baseline threshold from 20 to 3 for proper detection

2026-03-06 23:00:56 -05:00

website

CRITICAL FIX: Implement persistent menu loop returning to menu after operations

2026-03-05 21:59:41 -05:00