Documentation
Glossary
Definitions of terms used throughout the DeDDoS platform.
Overview
This page defines the technical terms, field names, and concepts you will encounter while using the DeDDoS platform. Terms are organized into these categories:
- Attack Types – the methods attackers use to disrupt targets
- Action Types – how the system responds to detected attacks
- Protocol and Network Concepts – networking terms that appear in data fields
- Application Sources – which system components generate records
- Data Fields – column names and field definitions for each viewer page
- Search Query Syntax – how to write search filters on viewer pages
- User Interface Terminology – controls, views, and features in the interface
- Administration Terminology – terms related to platform management
If you see an unfamiliar word or abbreviation anywhere in the platform, look it up here.
Attack Types
Attack types describe the method an attacker uses to disrupt a target. They appear in the AttackType field on the Notifications page and in the Type field on the Attacks page.
Volumetric – Flood Attacks
Flood attacks overwhelm a target by sending a massive volume of traffic. The goal is to exhaust bandwidth or processing capacity.
| Term | Definition |
|---|---|
| ICMP_FLOOD | The attacker sends a large number of ICMP (ping) packets to the target, consuming bandwidth and processing resources. |
| UDP_FLOOD | The attacker sends a high volume of UDP packets to random ports on the target, forcing it to respond to each one and eventually become unresponsive. |
| UDP_FRAG | A variation of a UDP flood that sends fragmented UDP packets. The target wastes resources trying to reassemble the fragments. |
| IPSEC_FLOOD | The attacker sends a flood of IPSec protocol packets, overwhelming the target’s ability to process encrypted communications. |
| ICMP_FRAG | A variation of an ICMP flood that sends fragmented ICMP packets, forcing the target to spend resources reassembling them. |
| PKT_FLOOD | A generic packet flood where the attacker sends a high volume of network packets regardless of protocol. This label is used when the detection system identifies a flood but does not classify it under a more specific type. |
Volumetric – Amplification Attacks
Amplification attacks exploit third-party services to multiply the volume of traffic directed at the target. The attacker sends small requests that produce much larger responses, all aimed at the victim.
| Term | Definition |
|---|---|
| DNS_AMPLIFICATION | The attacker sends small DNS lookup requests to open DNS servers, spoofing the target’s IP address. The DNS servers send their large replies to the target. |
| NTP_AMPLIFICATION | Similar to DNS amplification, but uses NTP (Network Time Protocol) servers. A small request triggers a much larger response directed at the target. |
| SMURF_ATTACK | The attacker sends ICMP ping requests to a network’s broadcast address, spoofing the target’s IP. Every device on that network replies to the target simultaneously. |
| FRAGGLE_ATTACK | Similar to a Smurf attack, but uses UDP echo packets instead of ICMP pings. The broadcast responses overwhelm the target. |
Protocol Attacks
Protocol attacks exploit weaknesses in network protocols (layers 3 and 4) to consume server resources or intermediate equipment capacity.
| Term | Definition |
|---|---|
| SYN_FLOOD | The attacker sends a large number of TCP connection requests (SYN packets) without completing the handshake, exhausting the target’s ability to accept new connections. |
| ACK_FLOOD | The attacker sends a flood of TCP ACK packets to the target, which must spend resources processing each one even though they do not belong to a real connection. |
| RST_FLOOD | The attacker sends a flood of TCP RST (reset) packets, disrupting existing connections and forcing the target to handle each reset. |
| PSH_FLOOD | The attacker sends a flood of TCP PSH (push) packets. PSH packets force the receiving system to push buffered data to the application layer immediately, consuming processing resources. |
| PING_OF_DEATH | The attacker sends malformed or oversized ping packets that exceed the maximum allowed size, potentially crashing or destabilizing the target system. |
| BGP | An attack targeting the Border Gateway Protocol, which is used to route traffic between networks on the internet. Disrupting BGP can reroute or black-hole traffic. |
Application-Layer Attacks
Application-layer attacks target specific services running on the target, such as web servers or DNS services. They are often harder to detect because each individual request can look legitimate.
| Term | Definition |
|---|---|
| DNS_QUERY_FLOOD | The attacker sends a massive number of DNS queries to a DNS server, overwhelming its ability to respond to legitimate lookups. |
| HTTP_FLOOD | The attacker sends a large number of seemingly valid HTTP requests (GET or POST) to a web server, consuming its capacity to serve real users. |
| HTTP_2_CONTINUATION_FLOOD | A variant of HTTP flood that exploits the HTTP/2 protocol’s CONTINUATION frames. The attacker sends many continuation frames that the server must process, exhausting its resources. |
| SLOWLORIS | The attacker opens many connections to a web server and keeps each one alive by sending partial HTTP requests very slowly. This ties up server connections without triggering rate limits. |
| RUDY | Short for “R-U-Dead-Yet.” The attacker sends HTTP POST requests with extremely long content-length headers, then transmits the body one byte at a time, keeping connections open indefinitely. |
Other
| Term | Definition |
|---|---|
| UNKNOWN | The system could not determine the attack type. This may appear when a notification does not include a recognized type. |
| GENERIC | A catch-all category for attacks that do not fit into a more specific classification. |
Action Types
Action types describe what the system did (or attempted to do) in response to a detected attack. They appear in the ActionType field on the Actions page.
Action Categories
| Term | Definition |
|---|---|
| BLOCK | The system blocked an IP address, preventing it from reaching the protected network. This is the most common automated response. |
| UNBLOCK | The system removed a previously applied block, restoring access for the IP address. |
| ALLOW | The system explicitly permitted traffic from an IP address, overriding any automated blocking rules. |
| MODIFY | The system updated an existing rule or entry, such as changing the expiration time or scope of a block. |
| DELETE | The system removed a rule or entry entirely. |
| CREATE | The system created a new rule or entry. |
| CLEAR_CACHE | The system cleared its internal memory of blocked hosts. After this action, previously blocked IPs will be evaluated again as if they were new. |
Action Destinations
These values indicate where the blocking or unblocking action was carried out.
| Term | Definition |
|---|---|
| FORTI_NET_BLOCK | The system added the attacker’s IP address to a block rule on a FortiNet firewall appliance, stopping traffic at the network perimeter. |
| FORTI_NET_UNBLOCK | The system removed an attacker’s IP address from the FortiNet firewall block rule. |
| WEB_SERVER_BLOCK | The system added the attacker’s IP address to the platform’s own Blocklist, preventing access at the web server level. |
| WEB_SERVER_UNBLOCK | The system removed an attacker’s IP address from the platform’s Blocklist. |
| CLEAR_BLOCKED_HOSTS_CACHE | The system cleared its internal cache of already-blocked hosts. This does not remove entries from the Blocklist or firewall; it only resets the Action Manager’s memory so it will re-evaluate IPs on the next notification. |
Protocol and Network Concepts
These terms describe network protocols and addressing concepts that appear in data fields throughout the platform.
| Term | Definition |
|---|---|
| TCP | Transmission Control Protocol. A connection-based protocol that ensures reliable, ordered delivery of data. Used by web browsers, email, and many other applications. Attacks like SYN_FLOOD and ACK_FLOOD target TCP. |
| UDP | User Datagram Protocol. A connectionless protocol that sends data without establishing a formal connection. Faster than TCP but less reliable. Attacks like UDP_FLOOD target UDP. |
| ICMP | Internet Control Message Protocol. Used for diagnostic and error-reporting purposes, such as the “ping” command. Attacks like ICMP_FLOOD target ICMP. |
| IP address | A numerical label assigned to every device on a network (for example, 192.168.1.10). The platform uses IP addresses to identify both attackers and targets. |
| Port | A number (0–65535) that identifies a specific service on a device. For example, port 80 is commonly used for web traffic and port 443 for secure web traffic. |
| Host | The IP address of the device being attacked (the target). This is the machine your organization is protecting. |
| Attacker / Attacker Host | The IP address of the device that is sending malicious traffic. |
| Internal network | A network range that belongs to your organization. The platform uses the Internal Networks list to distinguish your own traffic from external traffic. |
| Blocklist (Blacklist) | A list of IP addresses that are denied access to your protected systems. Managed on the Blocklist page. The system adds IPs here automatically when it responds to attacks, and administrators can add or remove entries manually. |
| Allowlist (Whitelist) | A list of IP addresses that are always permitted, even if they appear in attack traffic. Managed on the Allowlist page. IPs on the Allowlist are never blocked by automated actions. |
| FortiNet / FortiGate | A brand of network firewall appliance. When configured, the platform can push block rules directly to a FortiNet firewall to stop malicious traffic at the network edge. |
| CIDR notation | A compact format for describing a range of IP addresses. Written as an IP address followed by a slash and a number (for example, 192.168.1.0/24). The number after the slash indicates how many addresses are in the range – a smaller number means a larger range. Used on the Internal Networks page to define protected network ranges and on the Allowlist and Blocklist pages for IP entries. |
| OpenSearch | The search and analytics engine that stores attack data, action logs, and notifications behind the scenes. When the documentation mentions “OpenSearch query string syntax,” it refers to the search language you can use in the search box. You do not need to interact with OpenSearch directly – the platform handles all communication with it. |
| Deduplication | The process of combining multiple identical or near-identical notifications into a single record. The system uses deduplication to avoid acting on the same attack repeatedly within a short time window (typically 30 seconds). |
| TTL (Time to Live) | The duration (in seconds or minutes) that an entry remains valid in the system’s internal cache before it expires and is discarded. For example, a notification deduplication cache entry expires after a configurable number of seconds. |
Application Sources
The Application field on the Notifications and Actions pages indicates which system component generated the record.
| Term | Definition |
|---|---|
| WEB | The notification or action originated from the web platform itself. |
| DSS | The notification came from the DDoS Detection System, the DeDDoS packet-capture engine that monitors network traffic for attacks. Configured on the DSS settings page. |
| AI | The notification came from the AI-based detection module. Configured on the AI settings page. |
| AM | The record was generated by the Action Manager, the background service that executes automated defensive responses. Configured on the Action Manager settings page. |
| AGENT | The record was generated by an external agent or integration. |
| UNKNOWN | The source application could not be identified. |
Data Fields
These are the column names and fields you will see in tables and detail views throughout the platform. Fields are grouped by the page where they primarily appear.
Common Fields (All Viewer Pages)
| Field | Definition |
|---|---|
| LocalTime | The date and time when the record was created. All viewer tables label this column Recorded time (UTC) and show it as YYYY-MM-DD HH:MM UTC (for example 2026-10-13 06:52 UTC); hovering a value shows the raw stored timestamp. All viewer pages can be sorted by this field in ascending or descending order. |
| Guid | A unique identifier assigned to each record. Used internally to distinguish one record from another. |
| Host | The IP address of the target that was attacked or acted upon. |
| Port | The port number on the target that was involved in the attack or action. |
| Protocol | The network protocol used in the attack (for example, TCP, UDP, or ICMP). |
Actions Page Fields
These fields appear on the Actions page.
| Field | Definition |
|---|---|
| ActionType | What the system did in response to the attack. See Action Types above for possible values. |
| Execution status | A badge derived from the action’s Log showing whether the action Succeeded, is Pending, Failed, or has no recorded outcome (Status unavailable). |
| AttackerHost | The IP address of the attacker that this action targeted. |
| FirstSeen | The timestamp of the earliest notification that contributed to this action. |
| LastSeen | The timestamp of the most recent notification that contributed to this action. |
| Description | A brief summary of what the action accomplished. |
| Log | A detailed, timestamped log of every step the system took while executing this action. Useful for troubleshooting. |
| NotificationGuid | The unique identifier of the attack notification that triggered this action. Use this to cross-reference with the Notifications page. This field appears in the detail panel. |
| AttackStatisticsGuid | The unique identifier of the aggregated attack record associated with this action. Use this to cross-reference with the Attacks page. This field appears in the detail panel. |
Notifications Page Fields
These fields appear on the Notifications page.
| Field | Definition |
|---|---|
| Application | The system component that sent the notification. See Application Sources above. |
| AttackType | The type of attack detected. See Attack Types above for possible values. |
| Attackers | A list of IP addresses identified as sources of the attack. |
| Action | The action that was triggered by this notification (if any). |
| LastUpdated | The timestamp of the most recent update to this notification. Notifications are updated when duplicate detections are merged into the same record. |
| Description | Additional details about the notification provided by the detection system. Not all notifications include this field. |
| content | Raw content data included by some detection systems. This is a technical field that may contain unstructured information about the detected event. |
Attacks Page Fields
These fields appear on the Attacks page.
| Field | Definition |
|---|---|
| Type | The type of attack. See Attack Types above for possible values. |
| NotificationCount | The total number of individual notifications that were merged into this attack record. A high count means the attack was detected repeatedly. |
| Attempts | The number of distinct attack attempts or connections observed. |
| VolumeBytes | The total data volume (in bytes) sent to the target during the attack. Relevant for volumetric attacks like floods. |
| VolumeConnections | The total number of network connections directed at the target during the attack. |
| LastActionDate | The timestamp of the most recent defensive action executed for this attack. |
| ExecutedActions | A list of all defensive actions that were carried out in response to this attack. |
| BlockedHosts | A list of attacker IP addresses that were blocked as a result of this attack. Shown as Blocked attacker IPs in the details panel. |
| Response | A table column with an outcome badge derived from ExecutedActions and BlockedHosts: Blocked, Action executed, Action failed, or No action yet. |
| AttackersHostCount | A structured list of attackers involved in this attack. Each entry contains four sub-fields: IP (the attacker’s address), Count (how many times the attacker was observed), FirstSeen (when the attacker first appeared in this attack), and LastSeen (when the attacker was most recently detected). This field appears in the detail panel, not in the table columns. |
Search Query Syntax
The search box on all viewer pages and the Stats page accepts queries written in OpenSearch query string syntax. You do not need to learn this syntax to use the platform – you can click cell values to build filters automatically, or use Add filter on the Stats page – but understanding these patterns helps when you want to write precise queries by hand.
| Syntax | Meaning | Example |
|---|---|---|
plain text | Matches records containing the text in any field | SYN_FLOOD |
Field:"value" | Matches records where the specified field equals the value exactly | Host:"10.0.0.1" |
AND | Combines two conditions – both must match | Host:"10.0.0.1" AND Protocol:"TCP" |
NOT | Excludes records matching the condition | NOT ActionType:"CLEAR_BLOCKED_HOSTS_CACHE" |
OR | Matches records meeting either condition | Protocol:"TCP" OR Protocol:"UDP" |
_exists_:Field | Matches records where the field has any value | _exists_:Log |
* | Matches all records (wildcard) | * |
Field:value* | Trailing wildcard: matches values that start with the text (not for IP address fields) | Type:HTTP* |
Field:"network/prefix" | Matches IP address fields inside a network (CIDR notation) | Host:"10.10.40.0/24" |
Two restrictions apply on the viewer pages and on the Stats page: a search term cannot start with * or ? (leading wildcards such as Host:*foo are refused with Search terms cannot start with * or ? (leading wildcards are not supported). Use a trailing wildcard on text fields (for example Type:HTTP*) or CIDR notation on IP fields (for example Host:“10.10.40.0/24”).), and a query can be at most 4096 characters long (The search query is too long (maximum 4096 characters).). Viewer pages show the refusal in an error dialog; the Stats page shows it as a Results unavailable line under Query.
When you use the cell dropdown menu to click Add, Exclude, Exists, or NOT Exists, the platform writes these query expressions into the search box for you. Each click appends to the existing query with AND logic. Use the clear button in the search box (Clear query on the Stats page) to remove all filters and start fresh. On the Stats page, a query with an unclosed quote or unbalanced parentheses is rejected with an explanation before it is applied.
User Interface Terminology
These terms describe controls, views, and features you interact with in the platform’s interface.
Pages and Layout
| Term | Definition |
|---|---|
| Dashboard | The Stats page (titled Statistics), showing charts that summarize attacks, notifications and response actions for one applied time window. This is the first page you see after logging in. |
| Viewer | A page that displays records in a searchable, filterable table. The Actions, Notifications, and Attacks pages are all viewers. They share the same layout: a filter deck (Search & apply, Time range, Sort order), an Evidence columns manager, a search summary, and a results table with a details panel. |
| Administration | The Administration section, which contains tabs for managing users, groups, lists, and system configuration. Only the tabs your permissions allow are shown. Access requires the appropriate permissions. |
| Modal | A popup dialog that appears on top of the current page. Used for forms such as adding a new Blocklist entry, editing a user, or changing a password. Use its close or Cancel button to dismiss it. |
| Theme toggle | The sun/moon button in the navigation bar that switches between the dark theme (the default) and the light theme. The choice is stored with your session. |
| Account menu | The button on the right side of the navigation bar showing your initial and username. It opens a menu with the Current session username and Logout. |
| Remember me | A checkbox on the login screen. When checked, your session is kept for up to 30 days, even after the browser is closed. Use it only on a trusted workstation. |
| Session Expired | The dialog shown when your session is no longer active (after inactivity, or when it was ended elsewhere). Click Go to Login to log in again; you are returned to the page you were on. |
Stats Investigation Controls
These terms appear on the Stats page.
| Term | Definition |
|---|---|
| Investigation scope | The filter card at the top of the Stats page. It holds the search query, the time range and the auto-refresh setting, and applies them to every chart on the page when you click Apply filters. It can be collapsed with Collapse and reopened with Expand. |
| Draft | Changes to the investigation scope that have not been applied yet. While a draft is pending, the status badge reads Editing draft · applied results remain visible and the charts keep showing the previous results. Discard changes (or Escape) reverts the draft. |
| Applied window | The summary line below the investigation scope stating the exact time window, time zone and query the charts currently show. The same window and query are written into the page address so the view can be bookmarked or shared. |
| Add filter | The query builder on the Stats page. It inserts field conditions (Host is, Source IP is, Destination IP is, Protocol is, Attack type is) and the AND / OR operators into the search query. |
| Saved investigation | A named search query and time range saved from the Saved menu on the Stats page with Save current investigation…. Clicking a saved investigation applies it immediately. Saved investigations are private to your user account. |
| Auto-refresh | A Stats setting (OFF, 1m, 5m) that re-applies the current scope at the chosen interval. With a preset time range (for example Last hour) each refresh moves the window forward to the current time; a custom date range stays fixed. It pauses while a draft is pending. |
Viewer Filter Controls
| Term | Definition |
|---|---|
| Filter deck | The block of filter controls at the top of each viewer page: Search & apply, Time range, the From / To fields for custom ranges, and Sort order. Changes are staged and only take effect when you click Apply. |
| Search & apply | The search input on viewer pages with its Apply button. Type a keyword, IP address, or query expression and click Apply (or press Enter) to filter results. The clear button inside the input empties the search text. |
| Time range | The range selector on viewer pages: Last hour, Last 6 hours, Last day, Last 7 days, Last 30 days, Last 90 days, or Custom range. With Custom range, the From and To fields set an exact UTC window. On the Stats page the options are Last hour, Last 6 hours, Last day and Custom dates. |
| Sort order | The selector on viewer pages that controls how results are sorted, for example Recorded time DESC (newest first, the default) and Recorded time ASC (oldest first). Each viewer offers only its own fields: Recorded time, Host, Port and Protocol everywhere, plus Type on Attacks, Application on Notifications, and Action Type and Application on Actions. The choice is staged until you click Apply; sortable table headers use the same fields. |
| Search summary | The line above the table showing the window that was searched (Searched from → to), the time zone, the number of results and the active search query. It starts with Searched on all three viewer pages. |
| Evidence columns | The column manager on viewer pages (shown as, for example, “4 columns shown”). It lets you choose which data fields appear as table columns, search for a field, restore the Default columns, or Hide all columns. |
Table Controls
| Term | Definition |
|---|---|
| View (eye icon) | A button in the first column of each table row. Click it to open the details panel for that record. The row is highlighted while its panel is open. |
| JSON (code icon) | A button in the first column of each table row. Click it to download the raw record data as a JSON file. Useful for sharing with technical support or for further analysis. |
| Cell dropdown menu | The menu that appears when you click a data value in a table cell. It offers five options: Add (filter to matching rows), Exclude (hide matching rows), Show Chart (open a chart for that field), Exists (show rows where the field has a value), and NOT Exists (show rows where the field is empty). You can also middle-click a cell value to quickly add an exclusion filter. The menu opens outside the table so it is never cut off by the table edge. |
| Type chip | The compact label used for the attack type in the Attacks table. Click it to open the same filter menu as other cells. |
| Outcome badge | A colored status badge summarizing what happened in response to a record. On the Attacks page, the Response column shows Blocked (an attacker IP was blocked), Action executed, Action failed, or No action yet. On the Actions page, the badge shows the execution status. |
| Execution status | The outcome of a response action on the Actions page, read from the action’s execution log: Succeeded, Pending, Failed, or Status unavailable (the log does not record an outcome). |
| Total Results | The number of records matching the current filters. Large numbers are abbreviated (for example, 580,250 shows as 580.25 K). |
| Pagination | The page navigation controls below the table. Use numbered buttons, Next, and Previous to move between pages of results. |
Details Panel and Chart
| Term | Definition |
|---|---|
| Details panel | The panel that opens on the right side of a viewer page when you click a row’s View (eye icon) button, for example Attack details. It presents the record in labeled sections (such as Impact, Target, Timeline and Response on the Attacks page), with the remaining fields under a collapsible Technical record section and action buttons at the bottom. Under the title, a record line shows the record’s type, host and recorded time (on the Actions page together with the execution status badge). Dates in the panel are shown as YYYY-MM-DD HH:MM UTC, with the raw stored value on hover. The header has buttons to Show full screen, Minimize the panel, and Close it. Pressing Escape closes it. |
| Full screen | A view state of the details panel in which it covers the page width. Click the same button again to return to the side panel. |
| Minimized panel tray | The row of compact pills docked at the bottom-right of a viewer page. Each Minimize click turns the open details panel into a two-line pill: the record’s type and host on top (shortened if too long, full text on hover) and its recorded time underneath; opening another record while one is open also docks the previous one. Click a pill to restore that panel, or its X to close it. Pills stay until you close them or leave the page. |
| Chart view | A visualization mode opened by selecting Show Chart from a cell dropdown. A bar chart and summary table show how values are distributed for that field across all matching records. You can click chart bars or table values to add filters. Controls include an Export button, a Quick Search field, a size selector (the number of top values shown), and an Exit button. |
| Export | A feature that saves the current table data to a CSV file for use in spreadsheets or other tools. During export, a dialog shows progress with record counts. Click Download file when complete. |
Dashboard Charts
These chart types appear on the Stats page:
| Term | Definition |
|---|---|
| Count chart | A time-series area chart showing the number of records per hour across the applied window. Used for Attacks Count, Notifications Count and Actions Count. Hover over it to see a bucket’s exact count. |
| View chart data | A link below each count chart that expands a table with the exact count for every hourly time bucket. |
| Top 10 hosts ranking | A table listing the hosts with the most matching records, with Host and Records columns. Used for Top 10 Attacked Hosts, Top 10 Notifications Hosts and Top 10 Actions Hosts. |
| Expand / Collapse chart | Each chart panel has a button in its upper-right corner to widen the chart to the full page width (count charts also become taller) or return it to its original size. |
| Drill-down | Clicking a host in a top-hosts ranking, or the open-in-viewer icon next to a chart title, takes you to the related viewer page with the same time window and query. Clicking a host also adds a filter for that host. |
Loading and Empty States
| Term | Definition |
|---|---|
| Loading state | While data is being fetched, table rows are replaced by a skeleton animation and chart panels show a skeleton placeholder and the status Updating…. |
| NO RESULTS | Displayed when no records match the current filters and time window. Try widening the time range or clearing the search text, then apply again. |
| COULDN’T LOAD DATA | Displayed when a request failed, as opposed to returning no records. Click Retry to load the data again. |
Administration Terminology
These terms relate to the management and configuration sub-pages found under Administration.
Permissions and Access
| Term | Definition |
|---|---|
| users_groups | The Users / Groups permission. Grants access to the Users and Groups management pages. Without this permission, those tabs do not appear in the Administration section. |
| modify_settings | The Modify Settings permission. Grants view and edit access to the Internal Networks, Allowlist, Blocklist, AI, Action Manager, DSS, and Retention Policies pages. |
| view_settings | The View Settings permission. Grants read-only access to the same pages as Modify Settings: you can review the lists and settings, but add, edit and delete controls are not available. Without either settings permission, those tabs are hidden. |
| Superadmin | The built-in administrator account. It has full access to all platform features and cannot be edited, deleted, deactivated, or locked by other users. The only management action available on it is changing its password. |
Management Actions
| Term | Definition |
|---|---|
| Clear blocklist (truncate) | A destructive action on the Blocklist page (the Clear blocklist button) that removes every entry from the list in one step. A confirmation dialog states how many entries will be deleted and that the action cannot be undone. Requires the Modify Settings permission. |
| Lock / Unlock | An action on the Users page that prevents or restores a user’s ability to log in. A locked account still exists but cannot authenticate. |
| Active / Inactive | A status toggle on user accounts. Inactive users cannot log in. This is separate from the lock feature and provides another way to disable access. |
Administration Layout
| Term | Definition |
|---|---|
| Administration tabs | The strip of tabs at the top of the Administration section (Users, Groups, Internal Networks, Allowlist, Blocklist, AI, Action Manager, DSS, Retention Policies). Only the tabs your permissions allow are shown. |
| Row help tip | A small question-mark icon in front of the name in an Administration listing row. Hover over it (or focus it) to see what the row is and what its controls do. |
| Settings group | A collapsible section on the AI, Action Manager, DSS and Retention Policies pages that groups related settings under a heading with a settings count (for example Capture & processing). Click the heading to expand or collapse the group, or use Expand all / Collapse all. |
Settings Modules
| Term | Definition |
|---|---|
| Action Manager | The background service that processes attack notifications and executes automated defensive responses (blocking attacker IPs). Configured on the Action Manager settings page. |
| DSS | DDoS Detection System – the DeDDoS packet-capture and detection engine that monitors network traffic and sends attack notifications to the platform. Configured on the DSS settings page. |
| AI | The AI-based detection module that can identify attacks using machine learning. Configured on the AI settings page. |
Related Pages
- Getting Started – first steps and navigation overview
- Stats – visual dashboards and charts
- Actions – automated defensive action logs
- Notifications – incoming attack notifications
- Attacks – aggregated attack records and statistics
- Administration – system settings and list management
- Users – manage login accounts
- Groups – manage permission groups
- Allowlist – trusted IPs that are never blocked
- Blocklist – currently blocked IPs
- Internal Networks – protected network ranges
- AI – AI detection settings
- Action Manager – automated response settings
- DSS – DDoS Detection System settings
- Retention Policies – how long operational indices are kept