Events and reports
Ta treść nie jest jeszcze dostępna w Twoim języku.
The connector reports every decision it makes to Qlyne: who was let through, challenged, blocked, queued or caught in a trap, and why. The dashboard turns that into four screens. All of them work on Free.
Overview
Section titled “Overview”Open a site and you land on its Overview. Each product has a card with its state (on, observing, Needs Pro or off) and how many times it acted in the last 24 hours. Below the cards, next steps point to what is still missing, such as confirming the domain, turning on the scanner trap or running the first scan.
Observe, then enforce
Section titled “Observe, then enforce”Every site starts in observe mode: each rule counts what it would have done and lets the visitor through. While the site observes, the Overview shows a card with two numbers for the last 24 hours. Caught is what the rules would have acted on. Blocked is what was blocked anyway, such as an address on your block list. The Switch to enforce button takes you to the setting that changes the mode.
The mode belongs to the site, so enforcing turns on every product at once. In enforce mode the card goes away.
Report per product
Section titled “Report per product”Each product in the site menu has its own Overview with its report. Pick a period: the last 24 hours, 7 days, 30 days or 90 days. The report shows:
- the total of actions in the period, next to the previous period;
- what the product did, one line per action, and what it would have done in observe mode;
- block spikes, when there was one;
- where requests come from: the top IP addresses, networks, countries, paths, user agents and TLS fingerprints (JA4). Each IP address has a Block link, or says Blocked or Trusted.
Countries and networks come with the Cloudflare connector, or with the Qlyne proxy when it has a GeoIP database (see WAF & Firewall). TLS fingerprints come from the proxy; the Cloudflare connector does not send them.
Events
Section titled “Events”Events lists the decisions one by one, newest first: time, action, the rule in words, the visitor’s IP address, path and user agent. It is a sample: up to 5 of each kind of decision every 10 seconds, not every request. Visitors who pass are counted, not listed.
- Filter by Blocked, Challenged, Sent to the waiting room, Bot score or Observe mode only.
- Search by IP address, path, country or rule.
- Block or trust an IP address from its row, with a confirmation.
- Export CSV downloads what the filter shows, up to 5,000 rows, with the columns
time,action,rule,method,host,path,ip,country,asn,ja4anduser_agent.
Analytics
Section titled “Analytics”Analytics shows the site’s traffic hour by hour in stacked bars: passed, challenged, sent to the waiting room and blocked. The same periods apply, from 24 hours to 90 days. Below the bars come the block spikes explained, a table of decisions with the product behind each one, and the top countries, paths, IP addresses, networks and user agents, with the same Block link on each IP address.
IPv6 addresses are grouped by their /64 network, as the rate limits count them.
Spike e-mails
Section titled “Spike e-mails”Every 15 minutes Qlyne looks at each site’s last 48 hours. A spike is an hour with at least 50 blocked requests and five times the site’s usual hour. When a new spike shows up, every member of the account gets an e-mail in the account’s language, with the subject “[Qlyne] Block spike on” and the site. The e-mail gives the peak, the total and the usual figure, with a link to Events filtered on blocked. The first look at a new site only learns its usual traffic and sends nothing about the past.
How long it is kept
Section titled “How long it is kept”| What | Kept for |
|---|---|
| Totals per hour (bars, reports, the decisions table) | With no end date |
| Event samples | 120 days |
| Top lists (countries, paths, IP addresses, networks, user agents, JA4) | 7 days |
| Addresses banned by the scanner trap | Up to 24 hours |
Above 7 days, the bars, the decisions and the events come from the dashboard’s own history. The top lists then show the last 7 days. What each sample holds, and why, is on Privacy.
Limits
Section titled “Limits”- The mode is per site, not per product.
- Spike e-mails cover block spikes only. An origin that stops answering or a full waiting room sends no e-mail.
- The event filter takes a group and a search text, with no field-by-field filter.
- Page Shield and Attack Surface have their own screens instead of this report.