Attacks

How to Open This Page

Use the main application navigation bar to open Attacks. The page opens as Attack records (“Triage detected attacks and verify the response outcome.”) and shows the attacks recorded in the last 24 hours, newest first.

Overview

Each row on this page is one aggregated attack record: DeDDoS merges the notifications that describe the same attack (same target host, port, protocol, and attack type) into a single record and tracks how the platform responded to it. The page is built for triage: a response badge tells you at a glance whether the attack was blocked, and the detail panel groups the evidence by impact, target, timeline, and response.

All times on this page are UTC, as the UTC TIMELINE badge in the header reminds you.

Main Areas

Click to enlarge

• 1 Header - The page title Attack records, a one-line description, and the UTC TIMELINE badge.
• 2 Filter deck - Search box with the Apply button, Time range, From / To (UTC), and Sort order. A status line below the controls explains what is staged.
• 3 Evidence columns - Shows how many columns are visible and lets you manage them (Manage, Default, Hide all).
• 4 Results summary - The window that was actually searched, the time zone, the number of results, and the active search query.
• 5 Results table - One row per attack record, with view and JSON buttons, a Response badge, and the selected evidence columns.

Total Results and the page navigation sit below the table (scroll down when the table is longer than the window).

Filter Deck

The filter deck uses a single apply model: you can change the search text, the time window, and the sort order, and nothing is re-queried until you click Apply (or press Enter in the search box).

Search & Apply

Type into the Search attacks box (hint: Host, protocol, port, or attack type) and press Enter or click Apply. The search runs across all fields of the attack records, not only the visible columns.

• When the box contains text, an X (Clear search) button appears inside it. It clears the text only; click Apply to re-run the search without a query.
• Clicking Add, Exclude, Exists, or NOT Exists in a cell menu writes the condition into this box for you and runs the search immediately (see Cell Menus).

Search queries use OpenSearch query string syntax. Plain text matches any field; field-specific syntax looks like this:

Search restrictions:

• A search term cannot start with * or ? (a leading wildcard, for example Host:*foo or *flood). Such a search is refused with the message Search terms cannot start with * or ? (leading wildcards are not supported). Use a trailing wildcard on text fields (for example Type:HTTP*) or CIDR notation on IP fields (for example Host:“10.10.40.0/24”).. A * inside a quoted phrase, a lone * (all records) and Field:* (the field has any value) are allowed.
• A search can be at most 4096 characters long. A longer one is refused with The search query is too long (maximum 4096 characters).

A refused search is shown in an Error on performing operation! dialog, and the table shows no results until you correct the search and apply it again. IP address fields such as Host do not match wildcard patterns (for example Host:10.10.40.* finds nothing); use a network in CIDR notation instead, for example Host:"10.10.40.0/24".

Time Range

The Time range list (hint: UTC window) offers Last hour, Last 6 hours, Last day, Last 7 days, Last 30 days, Last 90 days, and Custom range.

When you pick a preset, the From / To fields are replaced by a Resolved window card that shows the exact UTC boundaries the query will use, with the reminder Press Apply to update results. The results do not change until you click Apply.

Click to enlarge

Custom From / To (UTC)

When Time range is Custom range (the default when the page opens, pre-filled with the last 24 hours), two fields appear:

• From - start of the window, format YYYY-MM-DD HH:MM, marked UTC.
• To - end of the window, same format.

Click a field to open the calendar (Choose start time / Choose end time) with a 24-hour Time selector in UTC, or type the value directly. The start must be before the end, and the end cannot be in the future; an invalid value is flagged under the field. The status line reads Custom range staged - Filters attack records by recorded UTC time. Changes apply only after Apply.

Click to enlarge

Sort Order

The Sort order list (hint: Staged until Apply) offers the sortable fields of attack records in both directions: Recorded time, Host, Port, Protocol, and Type, each with DESC and ASC. The default is Recorded time DESC (newest first). Sorting by Type orders the records alphabetically by attack type.

A changed sort order is staged: the SORT ORDER label is highlighted with a dot until you click Apply. You can also sort directly from the table header (see Results Table); header sorting applies immediately.

Evidence Columns

The Evidence columns bar (hint: Choose visible columns) summarizes the current column set, for example 4 columns shown - Recorded time · Host · +2.

• Manage - Opens the column picker (the button then reads Close).
• Default - Restores the default columns. It is disabled while the default set is already shown.
• Hide all - Hides every evidence column. A notice All evidence columns hidden. appears with a Restore default button.

Click to enlarge

The picker shows N shown · M available, a Search columns box, and one entry per field. Each entry says Shown in the table (check mark) or Hidden from the table (plus sign); click an entry to toggle it. Close the picker with Close, Esc, or a click outside it. Column changes apply immediately and do not re-run the search.

Default columns: Recorded time (UTC), Host, Port, and Type. The View and Response columns are always shown.

Available columns:

Results Summary

The line above the table shows what the table actually contains: Searched start → end, UTC, the number of results, and the committed search query in quotes (if any). While a request is running it reads Searching….

Because time-range and sort changes are staged, this line is the reliable reference for what you are looking at.

Results Table

Each row is one attack record.

• View column:
  • Eye icon (View) - Opens the detail panel for the record. The row and the icon are highlighted while its panel is open; click the eye icon again to close it.
  • Code icon (JSON, </>) - Downloads the complete record, exactly as stored, as a JSON file named after its GUID (for example docs-attack-….json).
• Response column - The outcome badge (see below).
• Evidence columns - Each value is a small button that opens a cell menu. Timestamps, volumes, and counts are formatted for reading; hover a value to see the raw stored value, which is also what filters and exports use.

Sorting from the header - Headers with a sort icon (Recorded time (UTC), Host, Port, Protocol, Type - the same fields as the Sort order list) are clickable. The first click sorts that column descending, the next click flips the direction; the arrow next to the header shows the active sort. Header sorting applies immediately and updates the Sort order list.

Response Outcome Badges

The Response badge is derived from the record’s Executed Actions and Blocked Hosts fields. Hover a badge to see the outcome and the blocked IPs.

Attack Type Chips

The Type column shows each attack type as a chip with a caret. Click the chip to open the same menu as any other cell (Add, Exclude, Show Chart, Exists, NOT Exists), for example to show only TCP SYN floods or to hide all HTTP floods.

Cell Menus (Fast Filtering)

Click any value in the table, including a type chip, to open its menu. The menu floats above the table, so it is never cut off by the table edge.

Click to enlarge

Conditions are joined with AND, so filters accumulate. The menu supports the keyboard (arrow keys, Esc to close). Middle-click (mouse wheel) a value to exclude it directly.

Pagination and Total Results

Total Results is shown below the table on the left (large numbers are abbreviated, for example 5.12 K). With more than one page of results (10 records per page), page navigation appears on the right: « (First) and ‹ (Previous) once you are past page 1, numbered pages with the current page highlighted, and › (Next).

Click to enlarge

Empty State

When nothing matches, the table shows NO RESULTS with the hint No matching records. Clear the search query or choose a wider time range above, then apply filters. If the request fails, an error message with a retry button is shown instead.

Click to enlarge

Detail Panel

Click the eye icon on a row to open Attack details as a panel on the right side of the page.

Click to enlarge

Panel header controls (top right):

• Show full screen / Exit full screen - Toggles a full-screen view. Double-clicking the panel header does the same.
• Minimize - Docks the panel into the tray at the bottom of the page.
• Close (X) - Closes the panel. Esc also closes it (unless a menu, picker, or calendar is open on top).

Under the panel title, a record line shows the attack type, the protected host and the recorded time, for example HTTP flood · 10.10.40.26 · 2026-10-13 09:08 UTC.

Panel content, from top to bottom:

• Summary - The attack type, the response outcome badge, and a magnitude badge derived from attempts and traffic volume: Critical volume (10,000+ attempts or 1 GB+), High volume (1,000+ attempts or 100 MB+), Elevated (100+ attempts or 10 MB+), or Low volume. While an attack is still active (no block or failure yet and seen within the last 15 minutes) an Ongoing · last seen … indicator pulses next to them.
• Impact - Attempts, Volume (bytes · connections), and Notifications (number of merged notifications).
• Target - Protected host (click it to copy the IP) and Protocol · port.
• Timeline - Recorded time · UTC, First → last seen · UTC, and Last action · UTC, each shown as YYYY-MM-DD HH:MM UTC. Hover a time to see the raw stored timestamp.
• Response - Executed actions and Blocked attacker IPs (click to copy).
• Technical record - A collapsible section (with a field count) holding every remaining field of the record, including the GUID, the per-attacker AttackersHostCount entries (IP, Count, FirstSeen, LastSeen), and an Elasticsearch record group with the index metadata. Values here have the same cell menus as the table. Dates, including the FirstSeen / LastSeen of each attacker, are shown as YYYY-MM-DD HH:MM UTC; hover a date to see the raw stored value, which is also what Add and Exclude write into the search.
• Footer buttons - Actions (opens the Actions page), Copy IP (copies the protected host IP), and JSON (downloads the raw record).

Opening another record while a panel is open moves the current panel to the tray automatically, so you never lose a record you were looking at.

Minimized Panels Tray

Minimized panels are docked as pills at the bottom right of the page. Each pill has two lines: the attack type and host on top (shortened with an ellipsis if it is too long; hover it to see the full text) and the recorded time underneath, which is always shown in full. Click a pill to restore that panel (the panel that was open goes to the tray in its place); click the X on a pill to close it. Pills stay until you close them or leave the page.

Click to enlarge

Chart View

Select Show Chart in any cell menu to open a chart panel for that field. It shows how the values of the field are distributed across all records matching the current search and time window, as a bar chart and a Field / Count table. The panel header shows only the name of the charted field (for example Type), not the details of a record.

Click to enlarge

Click a bar label or a value in the Field column to add it as a filter (middle-click to exclude it). The table below the chart can be sorted by Field or Count and has its own Rows per page setting and page navigation.

Understanding Attack Data

Key metrics to watch:

• Notification Count – A high number means the detection side kept reporting this attack, indicating sustained or repeated activity.
• Volume (Bytes) – Large values point to volumetric attacks such as UDP floods or amplification attacks.
• Volume (Connections) – High connection counts with low byte volume may indicate connection-exhaustion attacks such as SYN floods.
• Executed Actions and the Response badge – Confirm whether the platform responded automatically.
• Blocked Hosts – The attacker IPs that were blocked. Cross-check them with the Blocklist to verify their current status.

Common attack types:

The exact type labels shown in the table come from the detection engines (for example TCP SYN flood, DNS amplification).

Notes

• All times are UTC. The page opens with Custom range set to the last 24 hours.
• Search text, time range, and sort order are staged until you click Apply. Cell-menu filters, header sorting, and page changes apply immediately.
• Filters accumulate: each Add/Exclude appends an AND condition. Clear the search box and click Apply to start over.
• Your search text, time window, sort order, and column choice are remembered per browser tab (session storage). They survive navigation between pages in the same tab but not closing the tab.
• The JSON download contains the raw record as stored, including fields that are not shown in the table.
• Pagination reaches up to 1,250 pages (12,500 records). Narrow the time range or the search to reach older records in a larger result set.

Related Pages

• Actions – View the response actions executed for attacks.
• Notifications – View the individual notifications that are merged into attack records.
• Blocklist – Manage blocked IP addresses, including those blocked automatically in response to attacks.
• Stats – View aggregated attack statistics and dashboards.