hpnicfDDosAttackThreshold reports the traffic-rate threshold configured in the detecting policy that was exceeded to trigger the DDoS attack alert. Admins use this value from the trap to understand how the policy is currently tuned, helpful for judging whether the threshold needs adjusting to reduce false positives or catch attacks sooner. For example, a reported threshold of 10000 packets per second tells the admin that traffic exceeded that configured rate before the policy fired.