diff --git a/src/detect-engine-threshold.c b/src/detect-engine-threshold.c index ac6c72f615..7b0ed1f570 100644 --- a/src/detect-engine-threshold.c +++ b/src/detect-engine-threshold.c @@ -15,6 +15,17 @@ * 02110-1301, USA. */ +/** + * \defgroup threshold Thresholding + * + * This feature is used to reduce the number of logged alerts for noisy rules. + * This can be tuned to significantly reduce false alarms, and it can also be + * used to write a newer breed of rules. Thresholding commands limit the number + * of times a particular event is logged during a specified time interval. + * + * @{ + */ + /** * \file * @@ -658,3 +669,6 @@ void ThresholdContextDestroy(DetectEngineCtx *de_ctx) SCFree(de_ctx->ths_ctx.th_entry); } +/** + * @} + */ diff --git a/src/detect-threshold.c b/src/detect-threshold.c index bca1fb3767..96cec72aa4 100644 --- a/src/detect-threshold.c +++ b/src/detect-threshold.c @@ -15,12 +15,20 @@ * 02110-1301, USA. */ +/** + * \ingroup threshold + * @{ + */ + /** * \file * * \author Breno Silva * - * Implements the threshold keyword + * Implements the threshold keyword. + * + * The feature depends on what is provided + * by detect-engine-threshold.c and util-threshold-config.c */ #include "suricata-common.h" @@ -878,3 +886,7 @@ void ThresholdRegisterTests(void) { UtRegisterTest("DetectThresholdTestSig6Ticks", DetectThresholdTestSig6Ticks, 1); #endif /* UNITTESTS */ } + +/** + * @} + */ diff --git a/src/util-threshold-config.c b/src/util-threshold-config.c index a4c1d5c60e..3ff8824412 100644 --- a/src/util-threshold-config.c +++ b/src/util-threshold-config.c @@ -15,6 +15,11 @@ * 02110-1301, USA. */ +/** + * \ingroup threshold + * @{ + */ + /** * \file * @@ -1707,3 +1712,6 @@ void SCThresholdConfRegisterTests(void) #endif /* UNITTESTS */ } +/** + * @} + */