You may have seen that there are two diversion modes in NTA alerts. They are Auto IP diversion and Auto group diversion.
The Auto group diversion is triggered by the Region/IP Group Traffic Alert (at step 3 when configuring Regions or IP Groups).
The Auto IP diversion is triggered by the Region/IP Group DDoS Attack Alert (at step 4 when configuring Regions or IP Groups).
The Auto group diversion can divert top IPs in the IP range according to the configuration in the Diversion Policy for Abnormal Inbound/Outbound Traffic under the Traffic Diversion Rule.
