If you have more than one server or a network, you can partition your network into logical virtual partitions called VIDs. Each VID has a policy of its own and traffic behavior of its own. Each VID can be set into Detection or Prevention Mode independent of the others in each direction independently.

The virtualization is achieved using network address/mask which can be defined as a CIDR - going all the way up to a network node.

Once you have partitioned the network, you can baseline each partition independent of the other. Essentially, let the traffic flow and let the system collect the information.

This period can be as little as few hours or as much as a week or a month depending on how much time you have at hand. If you are already under attack, this step can be avoided and IntruGuard support staff can help you setup without the baselining based on their experience with attacks at similar sites.

The process of baselining involves granularly understanding the traffic behavior in the partition.

At the end of this stage, you get a Traffic Statistics Report. This report gives you an idea of the baseline of your traffic.

Once you have generate the Traffic Statistics Report, a wizard in the IntruGuard GUI will use that to set the behavioral thresholds with a configurable cushion. This cushion will take care of sudden surges such as those due to press campaigns, holiday shopping, etc.

Once the thresholds have been lowered, the appliance is still maintained in Detection Mode. In this mode, the appliance will act as though it has dropped attack packets and create reports and notifications. But it will not actually drop the packets.

If you are satisfied with the results, you can put the appliance partition in Prevention Mode.

In this mode, the appliance will actually enforce the policies and drop attack packets in the chosen direction for the chosen partition.

You will get the reports and notifications.