This object sets, for a given global interface type and protocol, how often the device checks whether a blacklisted interface is still under attack, removing it from the blacklist if the attack has stopped. Admins tune it to balance how quickly interfaces are automatically released from the blacklist against how thoroughly attacks are confirmed to have ended. For example, an admin might lower this from the default of 30 seconds to recheck blacklisted interfaces more frequently and restore service sooner after an attack subsides.