Understanding Threats

3 Event Types

**1) ALLOW** (green) Normal traffic. Nothing suspicious. - Legitimate users - Search engine bots - API clients

2) BLOCK (red)
Blocked traffic. Something is wrong.
- SQL injection attempts
- Path scanning (finding /admin, /wp-admin)
- Known attacker IPs
- Bot scanners

3) HONEYPOT (orange)
Traffic hit a trap.
- Attacker thought they found a target
- Actually hitting a fake path
- Gets logged with full details
- Gets blocked automatically

Sources

- **MANUAL** — you blocked it - **AUTO_BAN** — AI blocked it - **AUTO_HONEYPOT** — AI trapped it - **RULE** — firewall rule matched - **COLLECTIVE** — another customer saw this IP - **HONEYPOT_HIT** — attacker hit a trap