I think, with this, for the first detection, the ban would be zero minutes? As the previous decision count on the 1st detection will be 0?
(0 x 0) x 10 ?
You need the +1 so it is at least:
(((0 x 0) +1) x10)
In my case, using hours and multiplying x4:
duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) * GetDecisionsCount(Alert.GetValue()) + 1) * 4)
So we then get:
1st - 4 hour (zero prior decision count)
2nd - 8 hour (1 prior decision count)
3rd - 20 hour (2 prior decision count)
4th - 40 hour (3 prior decision count)