NetFlowAlertClaw

Use when judging whether a NetFlow alert is credible, suspicious, or unsupported from alert metadata and matched flow evidence.

Use when choosing a minimal DDoS mitigation strategy between near-destination and near-source scrubbing from destination-node load only.