Traffic Abnormal does not differentiate between alert types. Any instance where the total traffic volume for a single destination IP exceeds the threshold is considered a traffic anomaly.
An Explanation of Traffic Abnormal in the NTA DDoS Attack Alert
