This is a 64-bit counter, accumulated since the last reboot, of connections that were attempted but declined specifically because of security policy, including connections that failed authentication. An admin monitoring this counter can distinguish deliberate policy enforcement, such as an access rule or failed login, from other kinds of connection failures like resource exhaustion. For example, a spike in this counter coinciding with a new user rollout could indicate a misconfigured authentication policy is blocking legitimate connections rather than attackers.