This value reports the specific traffic threshold that was configured in the detection policy and subsequently exceeded, triggering this DDoS attack alert. Administrators use this to understand exactly what limit was breached, useful for evaluating whether the threshold itself needs adjusting if it's producing too many or too few alerts. For example, this field might read a value like 5000, indicating the policy's threshold of 5000 packets per second was crossed to trigger this specific attack detection.