USG Flex 200: Can i set a threshold limit on emails notificatons recieved from a Security Policy?

Lucas_Wilson

Scenario:
We recently applied a security policy called "Blocked_IPs" on a client's USG Flex 200. The goal was to prevent certain LAN IP addresses from accessing both the local network and the internet if their activity appeared suspicious.

Earlier today, we added a mobile device to the block list after detecting signs of botnet activity. The policy is configured to "Log alert" for all matching traffic, which—based on my understanding—generates an alert for every single connection attempt.

As a result, with the nature of botnet activity, our email inbox was flooded with alerts, most of which were unnecessary and overwhelming.

Suggested Improvement (if not already available):
It would be very helpful if the firewall offered a threshold or rate-limiting feature for alert notifications. For example, a configurable option to send a summary report of matched activity every 5 minutes—rather than individual alerts—would significantly reduce noise while still keeping us informed of potential threats.