Open Ask AI (⌘/Ctrl+I)
On this page

Security statistics

The Security statistics section of the Cockpit provides a summary of the security status of your environment.

This includes:

  • Origin: geographic origin of security events
  • Requests: blocked-request volume and rates
  • WAF: attacking IPs, user-agents, hosts, paths, and response codes

You can find information on specific metrics in the What is this? section of each check card in the Cockpit, and in Metric details below.

Select desired cluster

Select your desired cluster from the dropdown menu at the top of the Cockpit.

Select desired cluster in the Cockpit

View Security statistics

To view passed, logged, and blocked requests for your WAF:

  1. Go to Security > Statistics.
  2. Use the Sidebar filters to refine your view.
  3. Click each tab to view the corresponding metrics.

See Metric details for each metric by tab.

Metric details

Origin

Blocked request per origin

The number of blocked requests per origin shown on a map and in a table.

  • What is this? A view of blocked request volume by origin (geographic region), helping you see where blocked traffic is concentrated across regions such as metropolitan areas or countries.
  • Why it matters: Regional concentration patterns help distinguish between broad background noise and localized traffic anomalies. This gives clearer context when evaluating whether blocked traffic reflects expected protection behavior or indicates region-specific pressure.

Top WAF rules triggered

The top WAF rules triggered for each origin, listed by tag (rule tag) and count.

  • What is this? A ranked breakdown of which WAF rule tags are triggered most often, including how frequently each tag appears and where those triggers are originating.
  • Why it matters: Frequent patterns show which threat categories are most active and where filtering pressure is highest. This helps you assess whether the current protection profile aligns with observed request behavior.

Requests

Total blocked requests

The total count of blocked requests during the selected period.

  • What is this? The total number of requests blocked by the web application firewall in this environment during the selected period.
  • Why it matters: Provides a quick baseline view of overall blocked traffic in the selected period.

Blocked requests over time

Timeline showing the number of blocked requests over time.

  • What is this? A time-series graph of how many requests were blocked by the WAF in this environment over time.
  • Why it matters: Helps you identify when filtering activity spikes (for example during a traffic surge, new deployment, or configuration change) and correlate security events with operational activities.

Blocked requests rate over time

Timeline showing the rate of blocked requests over time.

  • What is this? A time-series graph of the blocked-request rate, expressed as requests per second for each time bucket (for example, 0.2 blocked requests/second).
  • Why it matters: Shows how filtering intensity changes across the period, not just total volume, so you can spot short-lived spikes or sustained pressure.

Blocked requests per protocol

The number of blocked requests per protocol.

  • What is this? A breakdown of blocked requests by HTTP protocol (HTTP/1.1, HTTP/2, HTTP/3).
  • Why it matters: Shows where blocked traffic concentrates across HTTP versions and helps distinguish normal client behavior from unusual protocol usage.

Blocked requests per HTTP method

The number of blocked requests per HTTP method.

  • What is this? A breakdown by HTTP method (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS, CONNECT).
  • Why it matters: Highlights which request intents are most frequently blocked and helps surface imbalances between read-oriented and write-oriented traffic.

WAF

Top attacking IPs

The top attacking IPs in the logs for your Magnolia project.

  • What is this? A ranked list of IP addresses that triggered the most blocked requests over the selected period.
  • Why it matters: Helps you identify concentrated source patterns in hostile traffic versus isolated events.

Top malicious user-agents

The top malicious user-agents in the logs for your Magnolia project.

  • What is this? A ranked list of user-agents that triggered the most blocked requests over the selected period.
  • Why it matters: Reveals recurring automation signatures and scanning behavior in incoming traffic.

Top targeted hosts

The top targeted hosts in the logs for your Magnolia project.

  • What is this? A ranked list of hosts that triggered the most blocked requests over the selected period.
  • Why it matters: Shows whether blocked activity is distributed or focused on specific host entry points.

Top targeted paths

The top targeted paths in the logs for your Magnolia project.

  • What is this? A ranked list of paths that triggered the most blocked requests over the selected period.
  • Why it matters: Highlights concentration patterns and recurring pressure on specific parts of the application.

WAF response repartition

The number of blocked requests per response code.

  • What is this? A breakdown of blocked requests by HTTP response code (for example 200, 403, 404, 500).
  • Why it matters: Shows how blocked-request handling outcomes split across status codes and helps interpret shifts in filtering behavior over time.