Documentation

Stats

Investigate attack, notification and response activity for one applied time window.

Overview

The Stats page (titled Statistics) is the main landing page after login. It reviews attack, notification and response activity for one applied time window: you define an investigation scope (a search query and a time range), apply it, and every chart on the page shows the same scope.

Use this page to get a quick visual summary of recent security events, spot trends, see which hosts are most affected, and jump from a chart straight into the matching records on the Attacks, Notifications or Actions pages.

The charts are loaded from server-side dashboard definitions, so the exact set of charts can differ between deployments. This page describes the standard configuration.

How to Open This Page

Click Stats in the navigation bar at the top of the page. The icon is a bar chart.

Stats is also the default page shown immediately after you log in.

Main Areas

1 Page heading - “Statistics” with the summary “Review attack, notification and response activity for one applied time window.”
2 Investigation scope - the filter card with the Search query, Time range and Run investigation sections.
3 Applied window - the summary line showing the time window and query the charts currently display.
4 Dashboard columns - the Attacks, Notifications and Response actions columns, each with a count chart and a top-hosts ranking.

Investigation Scope

The Investigation scope card at the top of the page controls which data all charts display. It works as a draft: changing the query or the time range does not change the charts until you click Apply filters. Until then, the charts keep showing the previously applied results (“Adjust the draft without changing the evidence currently shown”).

1 Collapse - hides the filter controls to give the charts more room. Click Expand to show them again.
2 Time zone badge - your browser’s time zone (for example UTC). All dates on the page are shown in this time zone.
3 Search query - the query input, with the Add filter and Saved buttons above it, the Clear query button inside it, and the Query help link below it.
4 Time range - the range selector (Custom dates by default) and, for custom ranges, the From and To date fields.
5 Run investigation - the Apply filters button, the status badge, the Discard changes link (when there is a pending draft), and the Auto-refresh selector.

Search Query

Type a query in the search input (placeholder “All records”) to limit the charts to matching records. An empty query matches all records. Queries use a field:value syntax, for example:

Host:10.10.40.20 - only records for a specific host
Host:10.10.40.21 OR Host:10.10.40.23 - records for either host
Host:10.10.40.20 AND AttackType:SYN_FLOOD - SYN flood records for one host

The query applies to attacks, notifications and response actions at the same time, so use fields that exist in the records you want to see. Host (the targeted host) is present in all three.

Click Clear query to empty the input. Like every other change, clearing the query only takes effect after you click Apply filters.

Press / anywhere on the page (when you are not typing in a field) to jump straight to the search input. If the Investigation scope card is collapsed, / expands it first.

Add Filter (Query Builder)

Click Add filter to open a small query builder below the search input. It inserts query fragments for you so you do not have to remember field names.

Click one of the field buttons: Host is, Source IP is, Destination IP is, Protocol is, or Attack type is. The matching fragment (for example Host:) is added to the query and the cursor is placed in the input.
Type the value (for example 10.10.40.20). Until you do, the builder shows “Enter a value for Host before adding another condition.”
To add another condition, click AND or OR, then choose the next field. The operator buttons only appear after the query contains at least one complete field:value condition.

If you add a field while the query already contains a condition, the builder joins it with AND automatically.

Query Help

Click Query help below the search input to expand short instructions and examples. Click it again to hide them.

Before applying, the query is checked for unbalanced syntax. If there is a problem, the query is not applied, an error appears below the input and Query help opens automatically:

Error	Cause
Close the open quote before applying this query.	A `"` is not closed.
Close the unmatched parenthesis before applying this query.	A `(` has no matching `)`.
Remove or match the closing parenthesis before applying this query.	A `)` has no matching `(`.

Queries Refused by the Server

Some queries pass this check but are refused by the server when the charts load:

Message	Cause
Search terms cannot start with * or ? (leading wildcards are not supported). Use a trailing wildcard on text fields (for example Type:HTTP*) or CIDR notation on IP fields (for example Host:“10.10.40.0/24”).	A term starts with `` or `?`, for example `Host:foo`. Use a trailing wildcard such as `AttackType:HTTP` instead. A lone `` and `Field:*` are allowed.
The search query is too long (maximum 4096 characters).	The query is longer than 4096 characters.

The query is still applied, but the charts cannot load: the status badge reads Filters applied · Some results unavailable, each chart shows COULDN’T LOAD DATA, and a single red row Results unavailable: followed by the server’s message appears under Query in the Applied Window summary. The row disappears as soon as you apply a valid query.

IP address fields such as Host do not match wildcard patterns (for example Host:10.10.40.* finds nothing); use a network in CIDR notation instead, for example Host:"10.10.40.0/24".

Saved Investigations

Click Saved to open the list of your saved investigations. A saved investigation stores a name together with the query and the time range, so you can repeat a common check with one click.

Save current investigation… - opens a name field (placeholder “e.g. Web farm, last day”) with Save and Cancel buttons. The current draft query and time range are saved under that name. Saving with an existing name replaces that entry.
Saved entries - each row shows the name and a scope summary (the query, or “All records”, plus the preset name or the exact date range). Click a row to apply that investigation immediately.
Delete (trash icon) - asks “Delete “name”?” in the row. Click Delete to confirm or Cancel to keep the entry.

Saved investigations are private to your user account. If you have not saved anything yet, the list shows “Nothing saved yet. Build a scope above, then choose “Save current investigation…”.” If the list cannot be loaded, the message “Saved investigations are unavailable right now.” appears with a Retry button.

Press Escape or click outside the list to close it.

Time Range

The Time range selector offers these options:

Option	Window
Last hour	The 60 minutes before you click Apply filters.
Last 6 hours	The 6 hours before you click Apply filters.
Last day	The 24 hours before you click Apply filters.
Custom dates	The exact window entered in the From and To fields. This is the default, pre-filled with the last 24 hours.

When a preset is selected, the From and To fields are hidden. The preset is converted into exact start and end times at the moment you apply it.

When Custom dates is selected, the From and To fields appear. Their labels include your time zone (for example From (UTC)). Click a field to open a calendar with a month selector and an hour/minute picker (24-hour format). You can also type a date in the yyyy-MM-dd HH:mm format.

When you apply custom dates, they are checked first. If they are invalid, the error appears below the field and the charts are not changed:

Enter a valid From date. / Enter a valid To date.
From must be before To.
From cannot be in the future. / To cannot be in the future.

Apply Filters and Status

Click Apply filters (or press Enter in the search input) to apply the draft. While the scope is being applied, the button reads Applying… and the controls are temporarily disabled.

The status badge below the button shows where you are:

Status	Meaning
Editing draft · applied results remain visible	You changed the query or time range but have not applied it. The charts still show the previous scope.
Applying filters…	The new scope is being applied.
Filters applied · Updating results…	The scope is applied and the charts are loading.
Filters applied · Results updated	All charts show the applied scope.
Filters applied · Some results unavailable	At least one chart failed to load. Use the Retry button in that chart.

While a draft is pending, a Discard changes link appears below the status. Click it (or press Escape inside the card) to return the controls to the applied scope.

Auto-Refresh

The Auto-refresh selector re-applies the current scope automatically:

Option	Behavior
OFF	No automatic refresh (default).
1m	Re-applies the scope every minute.
5m	Re-applies the scope every 5 minutes.

What a refresh does depends on the time range:

Preset (Last hour, Last 6 hours, Last day) - each refresh moves the window forward so that it ends at the current time. For example, with Last hour and 1m, the charts always show the most recent 60 minutes. The Applied window line and the page address are updated, and the Investigation scope card follows the moved window, so the refresh does not leave you with a pending draft.
Custom dates - the window stays exactly as you entered it; each refresh re-runs the same window, which picks up records that were added to it since the last update.

The setting is remembered for the rest of your session in this browser tab. Auto-refresh pauses while you have an unapplied draft, so it never overwrites your edits, and resumes once you apply or discard the draft.

Collapsing the Card

Click Collapse in the top-right corner of the card to hide the controls and keep only the card heading. Click Expand to show them again. The card remembers its collapsed or expanded state for the rest of your session in this browser tab. If the card is collapsed while a draft is pending, a Draft pending hint appears next to the Expand button.

Applied Window

Below the Investigation scope card, a summary line describes exactly what the charts show:

Applied window - the start and end of the applied time window with seconds, and the time zone.
Query - the applied query, or All records when no query is set.
Results unavailable - a red row with the server’s reason, shown only when the server refused the applied query (see Queries Refused by the Server).
A reminder that counts describe recorded events, not the current protection status, that the charts use hourly buckets, and that host lists rank matching records.

Each time you apply filters, the page address is updated with the applied window and query (the from, to and q URL parameters). You can bookmark the address or share it with a colleague: opening it restores the same window (as Custom dates) and query.

Dashboard Columns

The charts are grouped into three columns, each with a heading and a short description:

Column	Description	Charts
Attacks	Recorded attack activity and the hosts involved.	Attacks Count, Top 10 Attacked Hosts
Notifications	Detection notifications and their associated hosts.	Notifications Count, Top 10 Notifications Hosts
Response actions	Recorded actions and the hosts they relate to.	Actions Count, Top 10 Actions Hosts

If your deployment defines additional dashboards that do not belong to these three groups, they appear in an extra Additional statistics section.

Every chart panel contains:

A title, followed by an open-in-viewer icon (arrow out of a box).
An expand button in the upper-right corner.
The chart itself.
A status line at the bottom: Updating… while loading, Updated time when the data has loaded, or Update failed.

Count Charts

The Attacks Count, Notifications Count and Actions Count panels are area charts showing the number of recorded records per hour across the applied window. Hover over the chart to see the exact time bucket and count.

If the applied window contains only a single bucket, the panel shows the total as a large number instead of a chart.

View Chart Data

Below each count chart, click View chart data to expand a table with the exact values behind the chart: one row per hourly time bucket (Time) with its count. Click it again to hide the table. This is useful for reading exact numbers or for screen-reader users.

Top 10 Hosts

The Top 10 Attacked Hosts, Top 10 Notifications Hosts and Top 10 Actions Hosts panels rank the hosts with the most matching records in the applied window, as a table with Host and Records columns sorted from highest to lowest.

Click a host address to investigate it: you are taken to the matching viewer page (Attacks, Notifications or Actions) with the same time window and a Host:"<address>" filter added to the applied query.

Opening a Chart in Its Viewer

Click the open-in-viewer icon next to a chart title (tooltip View in Attacks, View in Notifications or View in Actions) to open the related viewer page with the same applied query and time window, so you can review the individual records behind the chart.

Expanding a Chart

Click the expand button (window icon, Expand chart) in the upper-right corner of a panel to widen it to the full width of the page. Count charts also become twice as tall, which makes individual hours easier to read. Click the button again (Collapse chart) to return the panel to its normal size.

Empty and Error States

When no records match the applied query and time window, each chart shows NO RESULTS, the queried window, and the hint “No matching records. Clear the search query or choose a wider time range above, then apply filters.”

Other states you may see:

State	Meaning and what to do
COULDN’T LOAD DATA with a Retry button (in a chart)	That chart’s data request failed. Click Retry. The other charts are not affected. If every chart shows it and a Results unavailable row appears under Query, the server refused the query itself: correct the query and apply it again (see Queries Refused by the Server).
Could not load dashboards with Retry dashboards	The chart definitions could not be loaded. Your filters are preserved; click Retry dashboards.
No dashboards configured with Reload dashboards	No dashboards are defined for this deployment. Ask your administrator to check the dashboard configuration.
Could not apply filters. Your previous results are preserved.	Applying the scope failed. Click Apply filters again.

Notes

Filters are remembered during your session. The applied query and time range persist as you navigate away and return to Stats. Logging out resets them.
The default time range is the last 24 hours, shown as Custom dates.
All charts share the same applied scope. There is no way to filter one chart independently of the others.
Nothing changes until you apply. Editing the query or time range only changes the draft; the charts keep showing the applied scope until you click Apply filters.
Counts are historical. The charts show recorded events in the applied window, not whether a host is currently protected or blocked.
Theme affects chart colors. The dark and light themes use different chart palettes, optimized for readability on each background.

Actions - detailed log of defensive actions the system has executed.
Notifications - individual attack notifications received by the system.
Attacks - aggregated attack records with statistics and attacker information.
Glossary - definitions of terms used on this page.