Any outbound traffic destined for a host that has been throttled or blocked is permitted.

When enabled, it is automatically globally activated.

It uses sFlow traffic sampling to determine whether traffic activity represents an intrusion.

It detects threats with both a signature-based engine and an anomaly-based engine that can

detect zero day attacks.