Threshold rules
The Threshold rule counts the number of events that matches the criteria you specify if the number of these events exceeds the number allowed within a time frame the Threshold rule executes.
An event is considered a repetition of another if the event has the same values for all the slots that are defined with the dup_detect=yes facet in the BAROC definition of its event class.
Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*