This article explains how events are handled when VeloCloud edge stateful firewall feature identifies that TCP half open connections threshold is hit.
Edge --> Configure --> Firewall --> Network & Flood protection --> TCP Half-Open Threshold Per Destination is configured
Once the threshold is hit, Edge will trigger an event "TCP half open connection limit reached". This event will not be sent to the Orchestrator (VCO).
Customer needs to configure a syslog server and enable syslog forwarding to view the events.