This article explains the difference between Smart rule and Flex rules in regards to their functionality, application and use case

The main difference between Smart-Rule and Smart rule and Flex rules  in Corero lies in their functionality and application:

• Smart-Rules are a patented high-performance heuristics-based engine that automatically detects volumetric DDoS attacks, including zero-day attacks.
• Flex-Rules are programmable filters that use the Berkeley Packet (BPF) syntax with Corero enhancements. They allow for customized filtering of traffic based on specific conditions.

Key Differences

Purpose:

• Smart-Rules: Automated detection of DDoS attacks.
• Flex-Rules: Customized traffic filtering.

Operation:

• Smart-Rules: Use heuristics to detect attacks automatically.
• Flex-Rules: Require manual configuration using BPF syntax.

Example Use Cases

• Use Smart-Rules for automatic detection and mitigation of volumetric DDoS attacks.
• Utilize Flex-Rules for creating custom filters to control specific traffic flows, such as blocking traffic from a particular IPv6 source.