Security incidents & IP dossier

Once the agent may read your web logs (grant-web-logs), each server’s Security tab shows who is hitting it, what the detection rules made of it, and whether it hurt the service. Everything here is evidence the agent summarized on the host — see Data & privacy for exactly what that is.

The Security tab

From top to bottom:

• Security checklist — the basics every exposed server should have. See Security checklist.
• Incidents — last 30 days — each one with its start, duration, whether the service was hurt or held, how many addresses were behind it, the 5xx served and the share of traffic that came from flagged addresses. Click one for its report.
• Attack and impact — last 24 h — the security timeline (below).
• Detections and Top sources — the rules that fired in the last 24 hours, and the busiest and most error-prone addresses. Click an address for its dossier.
• Secret files served — any .env, .git/config or backup a site answered with real content. Fix these first.
• Rules and their replay — every rule, and whether a replay of its exact current version cleared it to enforce.
• Blocking on this server — the warden’s mode and what it did lately, and fail2ban’s bans of the last day per jail.
• Configuration under attack — PHP workers against database connections, the slow query log, whether the web server logs the visitor behind a proxy.
• Replays — past-log replays you ran, and the command to run one.

The security timeline

One time axis, several series stacked so you can read straight down: requests and the share coming from addresses a rule had already fired on, the 5xx your sites returned, the machine’s load, and when each rule fired. It is how you tell an attack that was merely noisy from one that took a site down.

Incidents

Demerzel opens an incident where an attack and a symptom meet on that timeline: a real share of the traffic coming from flagged addresses, within ten minutes of the service being hurt — errors served to everyone but the flagged addresses, or a load above twice the server’s vCPUs. A massive flood of flagged traffic opens one on its own. A rule firing alone is not an incident: a public server is probed all day. Busy stretches less than 15 minutes apart belong to the same incident, and one still active is marked ongoing. An incident that hurt the service also raises an Action on the dashboard.

The incident report tells it in order:

• What happened — the story, step by step;
• Attack and impact — the timeline, zoomed on the incident with half an hour either side;
• Who was behind it — the top addresses, each linking to its dossier;
• Sites that suffered — which vhosts returned the errors;
• What Demerzel did — what the warden applied, extended, shadowed or refused while it happened;
• What the rules said — what each rule that fired would have done, had it been enforcing.

The IP dossier

Click any address — in Detections, Top sources or an incident — to open its dossier, across all your organization’s servers:

• What the warden did — every block, throttle, refusal and lift, per server, with the rule and the reason;
• Fleet decisions — the bans, unbans and operator protections Demerzel signed for this address, who or which server issued them, and until when;
• What fail2ban did — its bans and unbans, per jail, where the agent may read fail2ban’s log;
• Rules it tripped — every firing, with the rule version and the paths that triggered it;
• Servers it hit — its requests and status counts on each;
• What it asked for — sample paths (query strings removed) and the user agents it sent.

When the address came through Cloudflare, the dossier says so: the real clients are behind it, and only Cloudflare can stop them without cutting off your visitors.

Unban everywhere

With fleet decisions on, the dossier has an Unban on every server button for members who are not read-only. Give a reason — it is required, kept with the unban and in the activity log. Tick false positive and each server also demotes the rule that banned the address there. Every server that takes fleet decisions lifts the ban within a minute. An unban creates no allow: new evidence can ban the address again.

Replay results

A replay (demerzel-agent replay --send, see Replay past logs) gets its own page, linked from the Replays section: the range, the fingerprints of the rules, configuration and logs it ran on, the incidents it found, its timeline, what each rule would have done, and the log files it read. A replay’s incidents are kept apart from live ones and never raise an Action or an alert — they are the past.