Configure the default NXDOMAIN spike thresholds

The default NXDOMAIN spike thresholds apply to zones, shield configurations, and GTM domains where a spike threshold is not configured.

If NXDOMAIN spike thresholds are already set for a specific zone, shield, or GTM domain, those thresholds take precedence over the default settings. For more information, see Enable and configure NXDOMAIN spike detection.

To configure NXDOMAIN spike threshold to a zone:

1. From the Control Center menu, click Security > Security analytics > Infrastructure Security Analytics. The dashboard for Infrastructure Security Analytics appears.
2. At the top of the page, click Settings. The Default Settings window appears.
3. Configure the General settings. Complete these steps:
   1. In the General tab, enter the email address or addresses of users who you want to receive notifications about NXDOMAIN spike events, policy expiration, and more.
   2. Enable the toggle for NXDOMAIN Spike Alerting.
   3. To receive an alert when your policy settings are about to expire, enable the Expire Date Alerting toggle. To set an expiration date for settings that apply to an individual zone, shield, or GTM domain, see Set an expiration date for zone, shield, or domain settings.
4. Click the NXDOMAIN Spikes tab.
5. To configure the default dynamic threshold and default absolute threshold for a zone, complete these steps:
   1. In the Default Zone Dynamic Threshold field, enter a z-score or standard score value that must be met for zone traffic to be considered part of an NXDOMAIN spike.
   2. In the Default Zone Absolute Threshold field, enter a value for NXDOMAIN responses per second.
6. To configure the default dynamic threshold and default absolute threshold for a shield configuration, complete these steps:
   1. In the Default Shield Dynamic Threshold field, enter a z-score or standard score value that must be met for traffic to be considered part of an NXDOMAIN spike.
   2. In the Default Shield Absolute Threshold field, enter a value for NXDOMAIN responses per second.
7. To configure the default dynamic threshold and default absolute threshold for a GTM domain, complete these steps:
   1. In the Default GTM Dynamic Threshold field, enter a z-score or standard score value that must be met for traffic to be considered part of an NXDOMAIN spike.
   2. In the Default GTM Absolute Threshold field, enter a value for NXDOMAIN responses per second.
8. Click Confirm.