filter rule to detect certain pps

Hello -

is there a way to set up a filter rule in 2.9.x that would detect pps rate over a certain threshold? I’m getting sporadic bursts of about 2000 pps that I cannot pinpoint.

any ideas?


thanks,

Vlad