How to use check_threshold() to limit the number of notice? é.è

Zeek
1

Hello world,

I’ve a little question for the function check_threshold() from base/utils/thresholds.zeek, i’d like to add a threshold for the notice, but in order to make the question more brief, here I use the print setting instead of notice:

@load base/frameworks/notice/main
@load base/utils/thresholds

module Conn;
 
export{
        redef enum Notice::Type += { IP_WIRED };
        
        global detection_range: set[subnet] = set( 192.168.1.0/16 );
        global count_threshold: GLOBAL::TrackCount;
global notice_thresholds: vector of count = {1, 10};

        }
        
event connection_state_remove(c:connection)
        {
        if (check_threshold(notice_thresholds, count_threshold) && c$id$orig_h in detection_range)
        	{
        	print fmt("yes %s is in %s.", c$id$orig_h, detection_range);
        	}
        }

(or just click Try Zeek and choice exercise traffic and run)

I want the ip in the detection range in this packet to be printed when it appears for the first time and the tenth time. What changes should I make please?

Looking forward to your reply and Thank you very very much