The core issue is the high frequency of repeat email notifications for a single, ongoing threat, leading to alert fatigue. In Aruba Central, the Alert duration and threshold settings are specifically designed to manage this. By adjusting these parameters, an administrator can define conditions for triggering notifications, such as setting a time duration during which repeat instances of the same event are consolidated into a single alert, or a threshold that must be met before a notification is sent. This directly reduces notification volume for persistent threats without disabling the underlying threat detection.

A. Report scheduling settings: This configures the generation and delivery of periodic summary reports, not the real-time, event-driven alert notifications described in the scenario.

C. The IDS policy setting (strict, medium, or lenient): This adjusts the sensitivity of the IDS engine itself, determining what is considered a threat. It does not control the frequency of notifications for an already-detected threat.

D. The allowlist settings in the IDS policy: An allowlist (whitelist) would completely suppress all alerts for a specific signature or traffic flow, preventing admins from investigating a potentially valid threat, which contradicts the scenario's requirements.

1. Aruba Central User Guide: In the section on "Alerts & Events

" the configuration options for alerts are detailed. The documentation explains that administrators can configure alert notifications based on severity

device

and label. Advanced settings often include thresholds and time-based conditions to prevent "alert storms" from a single

persistent event. This directly supports adjusting duration and threshold settings to control notification frequency. (See the "Configuring Alerts and Notifications" section in the relevant Aruba Central User Guide version).

2. Aruba Central User Guide: The "Intrusion Detection and Prevention" section under the Gateway or Security configuration details the IDS policies (Strict

Medium

Lenient) and the use of allowlists. This documentation clarifies that these settings control detection rules and exceptions

respectively

not the notification logic for triggered events

thereby differentiating them from the correct answer. (See the "Configuring Security Policies for SD-WAN" or similar sections in the Aruba Central User Guide).