TL;DR
Read-only account security view. Incident counts come from Smart Detection transitions. Other zeros are stored telemetry. No GeoIP lookup and no Edge deploy.
Security → Threat Intelligence is a read-only page in the global navigation. It shows security telemetry for domains on your account. Staff who can view all domains see those accounts; a customer sees only their own domains. It does not change firewall rules, rate limits, or Edge configuration, and it does not deploy.
Blocked, challenged, request, and DDoS numbers come from stored security events, open DDoS attack events, and per-minute HTTP request totals. Empty values for those cards are zeros from those tables. The map uses the country code already stored on each event by the Edge. The page does not call a GeoIP service and does not show ASN. The country map is drawn from files shipped with the Backoffice. It does not load a map from an external network.
Active incidents come from Smart Detection transitions for domains that still have Smart Detection enabled. A domain counts while its latest transition is Elevated or Under attack. Turning Smart Detection off for that domain removes it from this list. If you set an operator override on that domain, the override is the state that counts. Under attack is the critical count. When the transition table is not installed, the incidents card says “Smart Detection not installed” and that card is not shown as zero. Other telemetry still appears.
Cards labeled “now” are active incidents, open critical alerts, current requests per second (the last full UTC minute, summed across edges that served the selected domains), domains under attack, and active edges. Domains under attack counts each of your domains once when either an open DDoS attack event exists or Smart Detection is enabled and the state is Under attack (shadow mode included). Turning Smart Detection off drops that domain from the Smart Detection part of the count. An active edge is one with a fresh heartbeat that also served your domains in the selected period. Cards labeled “selected period” are blocked, challenged, and suspicious percent. Suspicious percent is blocked plus challenged events divided by HTTP requests in that same window. Log-only managed WAF matches are not included in blocked, challenged, suspicious percent, or the map’s blocked and challenged counts. The map and country chart label those log-only matches separately. Query strings are removed from paths, and angle brackets are removed from paths and user agents before they are shown as text. A source IP is included only when you can already view that domain. A role without that access does not receive the address.
The event list shows UTC time, Ray ID, domain, IP when permitted, country, edge, method, path, rule, bot score when one was stored, action, reason, and user agent. Click a linked row to open Domain → Security → Events for that domain (filtered by Ray ID when the event has one). Rows without a working domain link are not clickable. Filter by time range, domain, and edge. Choosing another account’s domain or edge does not reveal that account. Search and country clicks narrow the list. Older pages and the live poll use a time-and-id cursor so two events at the same second are not skipped or repeated. The live poll is rate limited.
The domain filter is a search box. With the box empty, it lists up to 20 of your domains that had the most security events and HTTP requests in the selected time range, and it says “Type to search”. Typing a name waits about a quarter of a second, then matches domain names you can view (managed domains on your account, or every managed domain for staff who can view all domains). At most 50 matches are returned. The domain you pick is shown as a chip; clearing it returns to all domains. The page address keeps domain_id, so a refresh stays on that domain. All-domains totals count every domain you can view. They are not cut off after a fixed number of domains. When more than 20 edges appear in the period, the edge filter is a search box with the same keyboard behavior. With 20 or fewer edges, it stays a dropdown. Clearing an edge chip returns to all edges.
The page refreshes about every 5 seconds while the tab is visible, asking only for rows newer than the last cursor. The badge reads LIVE after a fresh response, RECONNECTING while a retry is backing off, DATA DELAYED when the tab is hidden or the last response is stale, and OFFLINE after repeated failures. Hidden tabs pause polling. Stale data is not labeled LIVE.
If the Control Plane is unavailable, this page cannot refresh. Edges keep serving the last deployed configuration. Traffic on the site does not depend on this dashboard.
