--- title: Threshold range for Tn and Tx description: The following table details the range of Tn and Tx for each attack type. component: pingintelligence version: 5.2 page_id: pingintelligence:pingintelligence_reference_guide:pingintelligence_threshold_range_tn_tx canonical_url: https://docs.pingidentity.com/pingintelligence/5.2/pingintelligence_reference_guide/pingintelligence_threshold_range_tn_tx.html revdate: April 3, 2024 --- # Threshold range for Tn and Tx The following table details the range of `Tn` and `Tx` for each attack type. When manually adjusting the threshold values, the values must fall within the specified ranges. | Attack Type | type\_id | Variable A (Range) | Variable B (Range) | Variable C (Range) | Variable D (Range) | Variable E (Range) | Variable F (Range) | | ----------------------------------------------------------------- | -------- | ----------------------------- | -------------------------- | -------------------------- | ------------------------- | ------------------- | --------------------- | | REST API | | | | | | | | | Data Exfiltration | 1 | Tn = \[1-32] Tx = \[2-33] | Tn = \[1-19] Tx = \[2-20] | Tn = \[1-99] Tx = \[2-100] | NA | NA | NA | | Single Client Login | 2 | Tn = \[1-19] Tx = \[2-20] | Tn = \[1-19] Tx = \[2-20] | NA | NA | NA | NA | | Multi Client Login | 3 | Tn = \[1-100] Tx = "na" | NA | NA | NA | NA | NA | | Stolen Cookie / Access Token | 4 | Tn = \[2-10] | Tn = \[1-19], Tx = \[2-20] | NA | NA | NA | NA | | API Memory Attack Type 1 | 5 | Tn = \[1-32] Tx = \[2-33] | Tn = \[1-19] Tx = \[2-20] | Tn = \[1-99] Tx = \[2-100] | NA | NA | NA | | API Memory Attack Type 2 | 6 | Tn = \[1-32] Tx = \[2-33] | Tn = \[1-19] Tx = \[2-20] | Tn = \[1-99] Tx = \[2-100] | NA | NA | NA | | Cookie DoS | 7 | Tn = \[1-9] Tx = \[2-10] | Tn = \[1-19] Tx = \[2-20] | NA | NA | NA | NA | | API Probing Replay | 8 | Tn = \[1-99] Tx = \[2-100] | NA | NA | NA | NA | NA | | API DoS Attack Type 1 | 9 | Tn = \[1-100] Tx = "\[2-100]" | NA | NA | NA | NA | NA | | Extreme Client Activity | 10 | Tn = \[1-19] Tx = \[2-20] | NA | NA | NA | NA | NA | | Extreme App Activity | 11 | Tn = \[1-19] Tx = \[2-20] | NA | NA | NA | NA | NA | | API DoS Attack | 12 | Tn = \[1- 100] Tx = "na" | NA | NA | NA | NA | NA | | API DDoS Attack Type 2 | 13 | NA | NA | NA | NA | NA | NA | | Data Deletion | 14 | Tn = \[1- 19] Tx = \[2-20] | Tn = \[1-99] Tx = \[2-100] | NA | NA | NA | NA | | Data Poisoning | 15 | Tn = \[1- 19] Tx = \[2-20] | Tn = \[1-99] Tx = \[2-100] | Tn = \[1-32] Tx = \[2-33] | NA | NA | NA | | Stolen Token Attack Type 2 | 16 | Tn = \[2-10] Tx = "na" | Tn = \[1-100] | Tn = \[1-100] | NA | NA | NA | | Stolen Cookie Attack Type 2 | 17 | Tn = \[2-10] Tx = "na" | Tn = \[1-100] | Tn = \[1-100] | NA | NA | NA | | API Probing Replay Attack 2 (client identifier: cookie) | 18 | Tn = \[1-99] Tx = \[2-100] | Tn = \[1-19] Tx = \[2-20] | NA | NA | NA | NA | | API Probing Replay Attack 2 (client identifier: token) | 19 | Tn = \[1-99] Tx = \[2-100] | Tn = \[1-19] Tx = \[2-20] | NA | NA | NA | NA | | API Probing Replay Attack 2 (client identifier: IP address) | 20 | Tn = \[1-99] Tx = \[2-100] | Tn = \[1-19] Tx = \[2-20] | NA | NA | NA | NA | | Data Exfiltration Attack Type 2 | 21 | Tn = \[1-42] Tx = \[2-43] | Tn = \[0-30] | Tn = \[1-100] | NA | NA | NA | | Excessive Client Connections (client identifier : cookie) | 22 | Tn = \[1-19], Tx =\[2-20] | NA | NA | NA | NA | NA | | Excessive Client Connections (client identifier : token) | 23 | Tn = \[1-19], Tx =\[2-20] | NA | NA | NA | NA | NA | | Excessive Client Connections (client identifier : IP address) | 24 | Tn = \[1-19], Tx =\[2-20] | NA | NA | NA | NA | NA | | Content Scraping Type 2 | 28 | Tn = \[1-29] Tx = \[2-30] | Tn = \[1-100] | NA | NA | NA | NA | | Unauthorized client attack (client identifier: IP address) | 29 | Tn = \[1-19] Tx = \[2-20] | Tn = \[1-19] Tx = \[2-20] | NA | NA | NA | NA | | Single Client Login Attack Type 2 (client identifier: IP address) | 30 | Tn = \[1-19] Tx = \[2-20] | Tn = \[1-19] Tx = \[2-20] | NA | NA | NA | NA | | Stolen API Key Attack- API Key | 31 | Tn = \[1-100] Tx = NA | Tn = \[1-100] Tx = NA | Tn = \[1-100] Tx = NA | Tn = \[1-100] Tx = NA | NA | NA | | Probing Replay Attack - API Key | 32 | Tn = \[1-100] Tx = NA | Tn = \[1-100] Tx = NA | NA | NA | NA | NA | | Extended Probing Replay Attack - API Key | 33 | Tn = \[1-100] Tx = NA | Tn = \[1-100] Tx = NA | NA | NA | NA | NA | | User Probing Type 1 | 34 | Tn = \[1-99] Tx = \[2-100] | Tn = \[1-99] Tx = \[2-100] | Tn = \[1-9] Tx = \[2-10] | Tn = \[1-9] Tx = \[2-20] | NA | NA | | User Probing Type 2 | 35 | Tn = \[1-99] Tx = \[2-100] | Tn = \[1-19] Tx = \[2-20] | Tn = \[1-19] Tx = \[2-20] | Tn = \[1-29] Tx = \[2-30] | NA | NA | | Sequence attack | 36 | Tn = \[1-19] Tx = \[2-20] | NA | NA | NA | NA | NA | | Header Manipulation | 37 | Tn = \[1-99] Tx = \[2-100] | Tn = \[1-20] Tx = NA | Tn = \[1-29] Tx = \[2-30] | Tn = \[1-100] Tx = NA | Tn = \[1-2] Tx = NA | Tn = \[1-100] Tx = NA | | Account Takeover -UBA | 38 | Tn = \[1-100] Tx = NA | Tn = \[1-99] Tx = \[2-100] | NA | NA | NA | NA | | User Data Exfiltration Type 2 | 39 | Tn = \[1-32] Tx = \[2-33] | Tn = \[1-32] Tx = \[2-33] | Tn = \[1-19] Tx = \[2-20] | NA | NA | NA | | User Data Injection | 40 | Tn = \[1-32] Tx = \[2-33] | Tn = \[1-19] Tx = \[2-20] | NA | NA | NA | NA | | Query Manipulation Attack | 41 | Tn = \[1-20] Tx = NA | Tn = \[1-2] Tx = NA | Tn = \[1-2] Tx = NA | Tn = \[1-100] Tx = NA | Tn = \[1-2] Tx = NA | Tn = \[1-100] Tx = NA | | Content Scraping Type 1 | 42 | Tn = \[1-19] Tx = \[2-20] | Tn = \[1-19] Tx = \[2-20] | Tn = \[1-19] Tx = \[2-20] | Tn = \[1-19] Tx = \[2-20] | NA | NA | | WebSocket API | | | | | | | | | WS Cookie Attack | 50 | Tn = \[1-99] Tx = \[2-100] | Tn = \[1-19] Tx= \[2-20] | NA | NA | NA | NA | | WS Identity Attack | 51 | Tn = \[1-19] Tx = \[2-20] | Tn = \[1-19] Tx = \[2-20] | NA | NA | NA | NA | | WS DoS Attack | 53 | Tn = \[1- 100] Tx = "na" | NA | NA | NA | NA | NA | | WS Data Exfiltration Attack | 54 | Tn = \[1- 100] Tx = "na" | NA | NA | NA | NA | NA |