In one embodiment, the detection policy is used to establish thresholds or limits which, when reached, trigger an alarm or other condition indicating that a security breach, attempted security breach, or other network security condition has occurred or is occurring.