Sets the maximum number of suspect users TAL will track at once. This bounds how much state SSG devotes to the suspect bucket, cssgTalSuspectUsers, during an anomaly like a spoofing attempt, so a flood of suspicious traffic can't grow that table without limit and start consuming resources that legitimate authorization processing needs. During a spoofing attack that would otherwise push cssgTalSuspectUsers into the tens of thousands, a cssgTalMaxSuspectUsers cap of 5000 stops SSG from devoting unbounded memory to tracking every suspicious flow individually.