NimbostratusIntermittenly seeing the alerts below, not finding any clear information online ?
ControlPlane.CorrelationEngine[22970]: ControlPlane.CorrelationEngine|CRIT|Apr 17 13:49:34.432|23063| [update_incident() at CorrelationEngine.cpp:2358] Limit of unique sessions for this incident reached
MVPme neither, try contacting support.
These log messages are informational and essentially the log above is for throttling the logging of the ASM correlation events.
New violating requests will continue to accumulate for this incident, but the counter of unique sessions is limited to prevent excessive memory usage. If this message appears frequently, it is far more likely that there are false positives than an attack. To reduce the number of correlated events, I suggest refining the policy.
