Delayed display of anomalies

The System has a tolerance period for delaying registration of anomalies to reduce the number of false positives. This delay is currently 2 minutes for all Protected resources by default. This delay period is regulated by Kaspersky DDoS Protection Technical Support experts. A delay period can be configured individually for each monitored parameter of each Protected resource.

The System also has an interval for merging points into an anomaly. By default, points exceeding the profile of the measured parameter that are no more than 3 minutes apart from each other are considered one anomaly.