Updated decription

1 files changed, 1 insertions, 1 deletions

diff --git a/doc/flow_risks.rst b/doc/flow_risks.rst
index 936fb2550..541b6d045 100644
--- a/doc/flow_risks.rst
+++ b/doc/flow_risks.rst
@@ -213,7 +213,7 @@ This risk is triggered when a TLS fatal alert is detected in the TLS flow. See `
 
 NDPI_SUSPICIOUS_ENTROPY
 =======================
-This risk is used to detect suspicious data carried in ICMP packets whose entropy (used to measure how data is distributed, hence to indirectly guess the type of data carried on) is suspicious and thus that it can indicate a data leak.
+This risk is used to detect suspicious data carried in ICMP packets whose entropy (used to measure how data is distributed, hence to indirectly guess the type of data carried on) is suspicious and thus that it can indicate a data leak. Suspicious values indicate random entropy or entropy that is similar to encrypted traffic. In the latter case, this can be a suspicious data exfiltration symptom.
 
 .. _Risk 036: