This object holds the name of the specific detection policy configured on the device that identified and flagged this DDoS attack, letting administrators trace which rule set was responsible for the detection. Administrators use this to know which policy's thresholds triggered the alert, useful when tuning detection sensitivity to reduce false positives or catch attacks earlier. For example, this field might read a policy name like 'web-server-protection' identifying which specific anti-DDoS policy detected the attack against that protected server.