search close

Events

access_time Updated Sep 21, 2021

About events

Events are actions that Signal Sciences takes as the result of regular threshold-based blocking, templated rules, and site alerts.

Viewing Events

Events can be viewed on the Events page of the console by going to Monitor > Events.

Alternatively, a short list of the most recent Flagged IP events is available in the Flagged IPs dashboard card. Clicking on the View button for any Flagged IP in the list will take you to the Events page.

The Events page

The Events page of the console shows a historical record of all flagged IP addresses within the last 30 days. This page provides detailed information about the event associated with this IP address, including:

  • A timeline illustrating the actions that occurred during the event. This includes:
    • When the IP address was identified as suspicious.
    • How many requests were received from the IP before it was flagged.
    • When the IP was flagged.
    • How many requests were blocked or logged.
  • A “Details” section providing additional, detailed information regarding the event. Depending on the nature of the attack, this can include the host, user agents, file paths, and country of origin.
  • A “Sample Request” highlighting a single request received during the event, including the request itself and the signals applied to it. Clicking on View this request will take you to the request details page for that request.

This page also provides controls for managing IP addresses that have been flagged, including:

  • Removing the IP address from the flag list.
  • Creating request rules to allow specific IP addresses.
  • Creating request rules to block specific IP addresses.