You can use alert thresholds to limit the number of alerts processed by Endpoint Security (HX) from Trellix Endpoint Security (HX) Agents in a hit storm (when excessive malware alerts are received by the Endpoint Security (HX)).
Three alert thresholds can be set:
The total alert threshold controls the total number of alert messages that can be processed by the Endpoint Security (HX). See Configuring the total alert threshold
The malware alert threshold controls the number of malware alerts for the same malware infection that can be processed by the Endpoint Security (HX) in a specified interval.
The IOC and exploit alert threshold controls the number of IOC and exploit alerts for the same infection that can be processed by the Endpoint Security (HX) in a specified interval.