How to detect and block slow intensity attack

[rattle007_beat]

Hello Guys,

We had an attack sometime back on a few URLs and we effectively did the rate limit for those to a very low number.
However, we can still see that these endpoints are targeted with a very low rate which can't be detected by the radar.

Is there a way we can detect this and block it somehow? Or what is the general go here. We let those low traffic come through because its too low to detect and any further rate limit will affect genuine requests?

Even if it cannot be detected using PFSense or any packages, I am interested to know about other options based on AWS or elastic.

TIA!

Let me know if this is a wrong forum to post this.