Tuning Thresholds

When to tune

The default thresholds work for most SFCC deployments, and volume floors scale automatically to your traffic size. Consider tuning when:

• You're getting false positives (alerts on legitimate traffic spikes)
• You're not catching known attacks (the thresholds are too loose for your traffic profile)
• Your site has unusual traffic characteristics (very low/high cache-hit ratios, naturally high 499s due to slow responses)

For predictable surges (sales, drops, launches), don't tune at all — declare a campaign window so volume detectors stay quiet for that window only.

How to tune

Go to Rules and review each detector's thresholds. The key dials:

ASN Spike

• multiplier is set per network type: datacentre traffic fires at a low multiplier (meaningful retail volume from cloud egress is almost always automated) while residential ISPs get a much higher one (normal daily swings are large). Lower a type for more sensitivity, raise it for fewer false positives.
• min_requests: the volume floor. Raise if low-traffic networks are creating noise.

499 Rate

• ratio_threshold: the 499 ratio that triggers the alert. Default 0.20 (20%). Lower if your site naturally has very few 499s.

Cache Bypass

• multiplier: how many times above the baseline bypass ratio. Default 3x. Depends heavily on your cache-hit baseline — let the source calibrate first.

Slow Burn

• total_deviation_pct: percentage growth that triggers. Default 50%. Lower to catch subtler creep.
• cache_hit_drop_pp: percentage-point drop in cache hit ratio. Default 15pp.

Ship-disabled detectors

Path Traffic Spike, IP Fan-out, Method Shift and the other abuse detectors ship disabled. Before enabling one, check its thresholds against your real traffic on the relevant page (Paths, IPs, Offenders) so you know roughly what it would have fired on.

Verify your changes

After updating a rule, the change takes effect on the next evaluation (within 60 seconds for fast detectors). Check the Alerts page to see if the new thresholds produce the expected behaviour.