IPS vs. Anti-virus/Anti-bot Log Suppression

[Timothy_Hall]

So Threat Prevention suppresses logs of substantially similar attacks that are run over and over to avoid overwhelming the logs.  For the IPS blade logs the suppression interval is 2 minutes as specified here:

sk108423: IPS generates Alerts instead of Logs

However the SK below states that the suppression interval for all Threat Prevention logs (which I'm assuming is including IPS) is 600 minutes (10 hours):

sk115876: Some fields are missing from IPS or Threat Prevention logs

So which is it?  My guess is that the 2 minute suppression period for IPS was true for R77.30 and earlier, but when IPS was rolled up into the rest of Threat Prevention in R80.10 it inherited the 10 hour suppression period?  I suppose I could set this up in my lab and try it but I thought it would be faster just to ask.

Because this will probably have be answered by R&D paging @PhoneBoy 

[PhoneBoy]

Your answer is at the bottom of sk108423:

R80.x IPS is part of Threat Prevention policy and is using the Threat Prevention log suppression, disregarding asm_excsv_log_flags. 
However, it still exist and is used in few low-level packet-sanity static protections.

Which means it should, for the most part, follow the Threat Prevention settings.
You can disable/modify the suppression as described in sk115876.

[Timothy_Hall]

Right I saw that but when they say "low level packet sanity static protections" in the SK are they talking about the Inspection Settings in the Access Control policy that used to be a part of IPS in R77.30? 

So in other words do the Inspection Settings use the old IPS 2-minute suppression, all other TP blades use the 10-hour suppression, and the logs for the oddball 39 Core Activations/Protections are never suppressed?

[PhoneBoy]

That all sounds correct to me.