Traffic Monitor

Live request feed with automatic threat classification — brute force, path traversal, injection, scanners, rate spikes, and geo outliers — plus one-click block rules.

Overview

Traffic Monitor shows a live feed of incoming requests and automatically classifies suspicious patterns — brute-force attempts, path traversal, injection probing, known scanner fingerprints, rate spikes, and geo-origin outliers. Flagged events are colour-coded and can be blocked with one click, and the right-hand panel shows a geo-origin breakdown alongside your active block rules.

Live vs. paused

Toggle the Live button in the header to pause or resume the streaming feed — useful when you want to inspect a specific burst of events without new rows pushing them off screen.

Quick Start

Open Traffic Monitor from the Security sidebar. The live feed starts streaming automatically.
Use the Threats toggle to show only flagged requests, or search by IP, path, or country.
Click any row to see its full detail — method, path, status, origin, and threat classification.
In the right panel, review the Geo-Origin breakdown of the last 200 requests.
Add a Block Rule (IP, CIDR, country code, or user-agent pattern) directly from the panel to start blocking a repeat offender.

Threat Categories

Category	What it flags
Brute Force	Repeated authentication attempts from one origin within a short window.
Path Traversal	Requests containing `../` or known directory-walk patterns (e.g. `/../../etc/passwd`).
Injection	SQL keywords or injection payloads in the request path or query string.
Scanner	User-agent strings matching known vulnerability scanners (sqlmap, Nikto).
Rate Spike	Request rate from a single origin exceeding the expected baseline.
Geo Outlier	Requests from a country outside your normal traffic distribution.

Features

Live Request Feed

A streaming table of incoming requests — time, IP, method, path, status, country, and threat classification — updated automatically while Live mode is on.

Geo-Origin Breakdown

A bar chart of request origins by country over the current window, so you can spot an unusual traffic source at a glance.

Block Rules

Add IP, CIDR, country-code, or user-agent block rules directly from the panel. Each rule tracks a running hit count.

AI Assistant

Every screen in Security Hub now ships with an embedded AI Assistant, opened from the vertical AI Assistant tab on the right edge of the screen. The assistant reads the data currently on screen — the current traffic stats and the most recent flagged events — and answers questions, triages findings, or drafts a remediation plan directly in the chat panel.

Traffic Summary

Get a plain-language summary of the current traffic security posture — flagged vs. blocked counts and the most common threat kinds right now.

Spike Root Cause

Ask which IP, country, or path is driving a current threat spike, with the assistant referencing the actual flagged events.

Block Rule Suggestions

Get concrete block-rule suggestions (IP, CIDR, country, or user-agent pattern) for the most repeated or severe threats seen.

Save as Report & Add Knowledge

Any assistant reply can be saved as a report (available later from My Reports) via the Save as Report button under the last message. Click Add Knowledge in the input dock to attach files or notes from your Knowledge library so the assistant's answers can reference them.

FAQ

Does adding a Block Rule here actually block traffic?

Block rules are tracked and displayed in Traffic Monitor for visibility and hit-count tracking. Wiring a rule to your actual reverse proxy or WAF is a separate integration step.

How far back does the feed go?

The live feed keeps the most recent 200 requests in view. Use the search and Threats filter to narrow down to what you need within that window.