Symptoms
In versions prior to 11.5.0, the dos_attack_tps / detection_average log output indicates the average TPS at the time the attack was detected, not the average TPS of the DOS attack.
Impact
The field doesn't fully describe what is happening during the DoS attack
Conditions
Using Splunk or Arcsight for DoS attack visibility
Fix Information
Remote Logging of DoS events: We changed the meaning of the "dos_attack_tps" field (in Splunk), and the "detection_average" field (in ArcSight) from
being the average TPS when an attack was detected to the average incoming TPS during a DoS attack (the 60-second average TPS of each IP or URL).
