You can customize the learning mode for DoS attack definitions using Master Attack Repository. Note that the changes that you make through Master Attack Repository feature affects the corresponding attack definitions in all the IPS policies. You can also edit DoS attack definitions per IPS policy.
Steps:
Click the Policy tab.
Select the root admin domain from the Domain drop-down list.
Select Intrusion Prevention → Policy Types → IPS.
Double-click on the row of the IPS policy you want to edit. The Attack Definitions page of the Master Attack Repository is displayed.
Double-click on the row of the attack category DOS Learning attack.
The Settings tab for the attack is displayed.
In the Severity checkbox select a different severity level from the drop-down list, if you want the attack to be of a higher or lesser priority.
In the Manager Actions area, select the options in the following fields:
To customize notifications,
Syslog
SNMP
E-Mail
Pager
Script
Auto-Acknowledgement Alert
After you complete the customizing the attacks, click Update. Click Save and deploy the configuration changes to the corresponding Sensors.