Notifications

How to Open This Page

Use the main application navigation bar to open Notifications. The page opens as Attack notifications (“Review detected attack events and their recorded evidence.”) and shows the notifications received in the last 24 hours, newest first.

Overview

A notification is a single attack event reported by a detection system (the DSS engine or one of the AI detectors). DeDDoS later merges the notifications that describe the same attack into one record on the Attacks page; this page lets you inspect the raw events one by one. The page is read-only.

All times on this page are UTC, as the UTC TIMELINE badge in the header reminds you.

Main Areas

Click to enlarge

• 1 Header - The page title Attack notifications, a one-line description, and the UTC TIMELINE badge.
• 2 Filter deck - Search box with the Apply button, Time range, From / To (UTC), and Sort order, with a status line below the controls.
• 3 Evidence columns - Shows how many columns are visible and lets you manage them (Manage, Default, Hide all).
• 4 Results summary - Searched followed by the window that was actually searched, the time zone, the number of results, and the active search query (the same summary line as on the Attacks and Actions pages).
• 5 Notifications table - One row per notification, with view and JSON buttons and the selected evidence columns. Total Results and the page navigation sit below it.

When you click the eye icon on a row, a Notification details panel opens on the right. You can also open a chart view from any value.

Filter Deck

The filter deck uses a single apply model: change the search text, the time window, and the sort order, then click Apply (or press Enter in the search box). Nothing is re-queried before that.

Search & Apply

Type into the Search notifications box (hint: Host, protocol, port, or application) and press Enter or click Apply. The search runs across all fields of the notifications, not only the visible columns.

• When the box contains text, an X (Clear search) button appears inside it. It clears the text only; click Apply to re-run the search without a query.
• Choosing Add, Exclude, Exists, or NOT Exists in a cell menu writes the condition into this box and runs the search immediately.

Search queries use OpenSearch query string syntax:

Search restrictions:

• A search term cannot start with * or ? (a leading wildcard, for example Host:*foo). Such a search is refused with the message Search terms cannot start with * or ? (leading wildcards are not supported). Use a trailing wildcard on text fields (for example Type:HTTP*) or CIDR notation on IP fields (for example Host:“10.10.40.0/24”).. A * inside a quoted phrase, a lone * (all records) and Field:* (the field has any value) are allowed.
• A search can be at most 4096 characters long. A longer one is refused with The search query is too long (maximum 4096 characters).

A refused search is shown in an Error on performing operation! dialog, and the table shows no results until you correct the search and apply it again. IP address fields such as Host do not match wildcard patterns (for example Host:10.10.40.* finds nothing); use a network in CIDR notation instead, for example Host:"10.10.40.0/24".

Time Range

The Time range list (hint: UTC window) offers Last hour, Last 6 hours, Last day, Last 7 days, Last 30 days, Last 90 days, and Custom range.

Picking a preset replaces the From / To fields with a Resolved window card that states the exact UTC boundaries, with the reminder Press Apply to update results.

Click to enlarge

Custom From / To (UTC)

With Custom range selected (the default when the page opens, pre-filled with the last 24 hours), the From and To fields take a YYYY-MM-DD HH:MM value in UTC. Click a field to open the calendar (Choose start time / Choose end time) with a 24-hour UTC Time selector, or type the value. The start must be before the end, and the end cannot be in the future; an invalid value is flagged under the field. The status line reads Custom range staged - Filters notification records by recorded UTC time. Changes apply only after Apply.

Click to enlarge

Sort Order

The Sort order list (hint: Staged until Apply) offers the sortable fields of notifications: Recorded time, Host, Port, Protocol, and Application, each as DESC or ASC. The default is Recorded time DESC (newest first).

A changed sort order is staged - the SORT ORDER label shows a dot - until you click Apply. Sorting from the table header applies immediately.

Evidence Columns

The Evidence columns bar (hint: Choose visible columns) summarizes the visible columns, for example 5 columns shown - Recorded time · Host · +3.

• Manage - Opens the column picker (the button then reads Close).
• Default - Restores the default columns; disabled while they are already shown.
• Hide all - Hides every evidence column and shows All evidence columns hidden. with a Restore default button.

Click to enlarge

The picker shows N shown · M available, a Search columns box, and one entry per field marked Shown in the table (check mark) or Hidden from the table (plus sign). Click an entry to toggle it. Close the picker with Close, Esc, or a click outside it.

Default columns: Recorded time (UTC), Host, Attack Type, Port, and Protocol.

Additional columns: Application, Attackers, Action, and Last Updated. The long Description text is not offered as a column; it is shown at the top of the detail panel instead.

Notifications Table

The first column is always View; the others follow your evidence-column selection. The Recorded time (UTC) column is shown as YYYY-MM-DD HH:MM UTC (for example 2026-10-13 06:52 UTC). Hover a time value to see the raw stored timestamp (ISO 8601 UTC with milliseconds, for example 2026-10-13T06:52:21.251Z); that raw value is also what Add and Exclude write into the search. The Last Updated column and every date in the detail panel use the same format, with the raw value on hover.

View Column

• Eye icon (View) - Opens the detail panel. The row and icon are highlighted while it is open; click the eye icon again to close it.
• Code icon (JSON, </>) - Downloads the full notification as a JSON file named after its GUID (for example docs-notification-….json).

Sorting from the Header

Headers with a sort icon (Recorded time (UTC), Host, Port, Protocol, and Application when shown - the same fields as the Sort order list) are clickable: the first click sorts descending, the next flips the direction, and an arrow marks the active sort. Header sorting applies immediately and updates the Sort order list.

Cell Menus

Every value in the table is a small button. Click it to open its menu; the menu floats above the table so it is never cut off.

Click to enlarge

Conditions are joined with AND. The menu works with the keyboard (arrow keys, Esc). Middle-click a value to exclude it directly.

Total Results and Pagination

Total Results is shown below the table on the left; large numbers are abbreviated (for example 5,120 is shown as 5.12 K). With more than one page of results (10 notifications per page), page navigation appears on the right:

Click to enlarge

• « (First) and ‹ (Previous) - shown once you are past page 1.
• Page numbers - the current page is highlighted. The number of page buttons adapts to the window width.
• › (Next) - go forward one page.

Empty State

When nothing matches, the table shows NO RESULTS with the hint No matching records. Clear the search query or choose a wider time range above, then apply filters. If the request fails, an error message with a retry button is shown instead.

Click to enlarge

Detail Panel

Clicking the eye icon on a row opens Notification details on the right side of the page.

Click to enlarge

Under the panel title, a record line shows the attack type, the notified host and the recorded time, for example HTTP flood · 10.10.40.26 · 2026-10-13 09:28 UTC.

The panel shows, from top to bottom:

• Attack type - The attack type in large text, followed by the detector’s Description of the event (for example HTTP flood detected against 10.10.40.26:80 (344,880 pps from 2 sources)).
• Evidence - Recorded time · UTC (for example 2026-10-13 09:28 UTC), Notified host, Traffic (protocol · port), and Application (the detector that reported it).
• Technical record - A collapsible section with a field count, holding all remaining fields: GUID, Last Updated (shown as YYYY-MM-DD HH:MM UTC; hover it for the raw value, which is also what Add and Exclude use), Action, Attackers (each attacker IP is a separate clickable value), and the OpenSearch metadata (notifications.index, notifications.id, notifications.version, notifications.score). Each value has the same cell menu as the table.

Panel header controls:

• Show full screen / Exit full screen - Toggles full-screen view (double-clicking the header does the same).
• Minimize - Docks the panel into the tray at the bottom of the page.
• Close (X) - Closes the panel. Esc also closes it, unless a menu, picker, or calendar is open on top. Clicking the row’s eye icon again closes it as well.

Minimized Panels Tray

Minimized panels are docked as pills at the bottom right of the page. Each pill has two lines: the attack type and host on top (for example HTTP flood · 10.10.40.26; shortened with an ellipsis if it is too long, hover it to see the full text) and the recorded time underneath (for example 2026-10-13 09:28 UTC), which is always shown in full. Click a pill to restore it, or its X to close it. Opening another notification while a panel is open moves the open one into the tray automatically, so you can keep several notifications at hand. Pills stay until you close them or leave the page.

Click to enlarge

Chart View

Selecting Show Chart in a cell menu opens a chart panel for that field: a bar chart plus a Field / Count table of how often each value occurs across the notifications that match the current search and time window. The panel header shows only the charted field, not the details of a notification.

Click to enlarge

Chart Controls

Bar Chart and Summary Table

Each bar is one value of the field, its height proportional to the count; hover a bar to see the exact count. The summary table below lists each value with its count and can be sorted by Field or Count. It has its own pagination: Rows per page (10, 15, 20, 25, or 30), a range indicator (for example 1-8 of 8), and first / previous / next / last page buttons.

Click a bar label or a value in the Field column to add it as a filter; middle-click to exclude it. The notifications table updates immediately.

Notification Fields Reference

Not every notification contains every field; the fields depend on the detection system that generated it.

Notes

• All times are UTC. The page opens with Custom range set to the last 24 hours. If you see no results, choose a wider time range and click Apply.
• Search text, time range, and sort order are staged until Apply. Cell-menu filters, header sorting, and page changes apply immediately.
• Filters accumulate: each Add/Exclude appends an AND condition. Clear the search box and click Apply to start fresh.
• Your search text, time window, sort order, and column choice are remembered per browser tab (session storage).
• The page is read-only. Notifications are created by the detection systems and processed by the Action Manager.
• Clicking a value never navigates away from the page; it refines the search in place.

Related Pages

• Actions – view the response actions executed for notifications
• Attacks – view the attack records built from notifications
• Blocklist – manage IP addresses blocked as a result of attack notifications
• Allowlist – manage trusted IP addresses that are excluded from blocking
• Action Manager – configure how the system processes notifications and executes automated responses