Справочник Пользователя для Fortinet IPS

To view the anomaly list, go to Intrusion Protection > DoS Sensor.

Because an improperly configured DoS sensor can interfere with network traffic, 
no DoS sensors are present on a factory default FortiGate unit. You must create 
your own and then enable them before they will take effect. Thresholds for newly 
created sensors are preset with recommended values that you can adjust to meet 
the needs of your network.

To configure DoS sensors, go to Intrusion Protection > DoS Sensor. Select the 
Edit icon of an existing DoS sensor, or select Create New to create a new DoS 
sensor.

Add a new DoS sensor to the bottom of the list.

A unique identifier for each DoS sensor. The ID does not indicate the 

sequence in which the sensors examine network traffic.

Select to enable the DoS sensor.

The DoS sensor name.

An optional description of the DoS sensor.

Delete the DoS sensor.

Edit the following information: Action, Severity, and Threshold.

Create a new DoS sensor before the current sensor.

Move the current DoS sensor to another position in the list. After 

selecting this icon, enter the destination position in the window that 

appears, and select OK.

Note: It is important to know normal and expected network traffic before changing the 
default anomaly thresholds. Setting the thresholds too low could cause false positives, and 
setting the thresholds too high could allow otherwise avoidable attacks.