search close

Observed Sources

access_time Updated Jul 28, 2021

The Observed Sources page provides an overview of all IPs that have been—or soon will be—flagged on your site. The Observed Sources page is divided into separate tabs for Suspicious IPs, Flagged IPs, and Rate Limited Sources.

The Observed Sources page can be viewed by going to Monitor > Observed Sources in the console:

The Observed Sources page can also be viewed by clicking on the combined count of all Observed Sources on the site overview page:

Suspicious IPs

The Suspicious IPs tab shows IP addresses from which requests containing attack payloads have originated, but the volume of attack traffic from these IPs has not exceeded the decision threshold. Once the threshold is met or exceeded, an IP address will be flagged and added to the Flagged IPs list. The Suspicious IPs tab enables you to anticipate which IPs may soon be flagged.

The Suspicious IPs tab lists:

  • The IP
  • Country of origin
  • The signal for which the IP is approaching a threshold
  • The threshold being approached
  • How long ago the IP was added to the Suspicious IPs list
  • If the IP was flagged by another Signal Sciences customer

Clicking on an IP in the Suspicious IPs list will take you to a Requests page search for that IP.


Flagged IPs

The Flagged IPs tab shows all IP flagging events. IP addresses can be flagged through regular threshold-based blocking, templated rules, and site alerts.

The Flagged IPs tab lists:

  • The IP
  • Country of origin
  • The signal the IP was flagged on
  • How long ago the IP was flagged
  • If the IP is still currently flagged

Clicking on an IP in the Flagged IPs list will take you to a Requests page search for that IP.


Rate Limited Sources

Note: Rate Limit rules are only included with the Premier platform. They are not included as part of our Professional platform.

The Rate Limited Sources tab shows all sources that have been rate limited.

The Rate Limited Sources tab lists:

  • The source
  • The signal the source was rate limited on
  • When the source will stop being rate limited

This page also provides controls for managing sources that have been rate limited, including:

  • Removing all entries from the rate limited sources list
  • Removing specific sources from the rate limited sources list
  • Creating request rules to allow specific sources
  • Creating request rules to block specific sources