ESET PROTECT – Table of Contents

Throttling Examples

Throttling examples explain how the throttling conditions (T1, T2, S1, S2, S3) are combined and evaluated.

Note

"Tick" means impulse from the trigger. "T" stands for time-based criteria, "S" stands for statistical criteria. "S3" stands for event log criteria.

S1: Criterion for occurrences (allow every third tick)

Time

00

01

02

03

04

05

06

Trigger is modified

07

08

09

10

11

12

13

14

15

Ticks

x

x

x

x

x

x

x

 

x

x

 

x

x

 

x

 

x

S1

 

 

1

 

 

1

 

 

 

 

 

1

 

 

 

 

1

S2: Criterion for occurrences within time (allow if three ticks occur within four seconds)

Time

00

01

02

03

04

05

06

Trigger is modified

07

08

09

10

11

12

13

Ticks

x

 

x

x

x

x

 

 

x

 

x

 

x

x

x

S2

 

 

 

1

 

 

 

 

 

 

 

 

 

1

 

S3: Criterion for unique symbol values (allow if three unique values are in a row)

Time

00

01

02

03

04

05

06

Trigger is modified

07

08

09

10

11

12

13

Value

A

B

B

C

D

G

H

 

J

K

n/a

L

M

N

N

S3

 

 

 

 

1

 

 

 

 

 

 

 

 

1

 

S3: Criterion for unique symbol values (allow if three unique values are since the last tick)

Time

00

01

02

03

04

05

06

07

Trigger is modified

08

09

10

11

12

13

14

Value

A

B

B

C

D

G

H

I

 

J

K

n/a

L

M

N

N

S3

 

 

 

1

 

 

1

 

 

 

 

 

1

 

 

 

T1: Allow a tick in certain time ranges (allow every day starting at 8:10, duration 60 seconds)

Time

8:09:50

8:09:59

8:10:00

8:10:01

Trigger is modified

8:10:59

8:11:00

8:11:01

Ticks

x

x

x

x

 

x

x

x

T1

 

 

1

1

 

1

 

 

This criterion has no state; therefore trigger modifications have no effect on the results.

T2: Allow a single tick in a time interval (allow at most once every five seconds)

Time

00

01

02

03

04

05

06

Trigger is modified

07

08

09

10

11

12

13

Ticks

x

 

x

x

x

x

 

 

x

 

x

 

x

x

x

T2

1

 

 

 

 

1

 

 

1

 

 

 

 

1

 

S1+S2 combination

•S1: every fifth tick

•S2: three ticks within four seconds

Time

00

01

02

03

04

05

06

07

08

09

10

11

12

13

14

15

16

Ticks

x

x

x

x

x

 

x

x

x

 

 

x

 

x

x

 

 

S1

 

 

 

 

 

 

 

 

 

 

 

 

 

 

1

 

 

S2

 

 

1

 

 

 

1

 

 

 

 

 

 

 

1

 

 

Result

 

 

1

 

 

 

1

 

 

 

 

 

 

 

1

 

 

The result is enumerated as: S1 (logical or) S2

S1+T1 combination

•S1: Allow every third tick

•T1: Allow every day starting at 8:08, duration 60 seconds

Time

8:07:50

8:07:51

8:07:52

8:07:53

8:08:10

8:08:11

8:08:19

8:08:54

8:08:55

8:09:01

Ticks

x

x

x

x

x

x

x

x

x

x

S1

 

 

1

 

 

1

 

 

1

 

T1

 

 

 

 

1

1

1

1

1

 

Result

 

 

 

 

 

1

 

 

1

 

The result is enumerated as: S1 (logical and) T1

S2+T1 combination

•S2: three ticks within ten seconds

•T1: Allow every day starting at 8:08, for a duration of 60 seconds

Time

8:07:50

8:07:51

8:07:52

8:07:53

8:08:10

8:08:11

8:08:19

8:08:54

8:08:55

8:09:01

Ticks

x

x

x

x

x

x

x

x

x

x

S2

 

 

1

1

 

 

1

 

 

1

T1

 

 

 

 

1

1

1

1

1

 

Result

 

 

 

 

 

 

1

 

 

 

The result is enumerated as: S2 (logical and) T1.

Note that the state of S2 is reset only when the global result is 1.

S2+T2 combination

•S2: three ticks within ten seconds

•T2: Allow at most once every 20 seconds

Time

00

01

02

03

04

05

06

07

…

16

17

18

19

20

21

22

23

24

Ticks

x

x

x

x

x

x

x

x

 

x

x

x

x

x

x

x

x

x

S2

 

 

1

 

 

1

1

1

 

 

 

1

1

1

1

1

 

 

T2

1

1

1

 

 

 

 

 

 

 

 

 

 

 

 

1

 

 

Result

 

 

1

 

 

 

 

 

 

 

 

 

 

 

 

1

 

 

The result is enumerated as: S2 (logical and) T2.

Note that the state of S2 is reset only when the global result is 1.