search close

Events

access_time Updated Jun 29, 2022

About events

Events are actions that Signal Sciences takes as the result of regular threshold-based blocking, templated rules, and site alerts.

Viewing Events

Events can be viewed on the Events page of the console.

  1. Log in to the Signal Sciences console.

  2. Select a site if you have more than one site.

  3. From the Monitor menu, select Events. The Events page appears.

Alternatively, a short list of the most recent Flagged IP events is available in the Flagged IPs dashboard card. Clicking the View button for any Flagged IP in the list will take you to the Events page.

The Events page

The Events page of the console shows a historical record of all flagged IP addresses within the last 30 days. This page provides detailed information about the event associated with this IP address, including:

  • A timeline illustrating the actions that occurred during the event. This includes:
    • When the IP address was identified as suspicious.
    • How many requests were received from the IP before it was flagged.
    • When the IP was flagged.
    • How many requests were blocked or logged.
  • A “Details” section providing additional, detailed information regarding the event. Depending on the nature of the attack, this can include the host, user agents, file paths, and country of origin.
  • A “Sample Request” highlighting a single request received during the event, including the request itself and the signals applied to it. Clicking View this request will take you to the request details page for that request.

This page also provides controls for managing IP addresses that have been flagged, including:

  • Removing the IP address from the flag list.
  • Creating request rules to allow specific IP addresses.
  • Creating request rules to block specific IP addresses.