Overview of Analysis & Logs
Last update：2026-08-20 14:34:59
Reading time: About 3 minutes
The Analysis & Logs module provides comprehensive security visualization and analysis tools that help you monitor your website’s security status in real time, respond quickly to security incidents, and continuously refine your protection strategies.
Module Navigation
| Module | Purpose | Use When |
|---|---|---|
| Web Security Trends | View overall traffic trends and protection effectiveness across all protected hostnames from a global perspective | Reviewing overall protection effectiveness, performing routine security inspections, and quickly identifying hostnames with security risks |
| L3/4 DDoS Trends | View the overall protection status against network-layer (L3/4) DDoS attacks, including peak attack bandwidth/packet rate, trends, and attack event details | Analyzing L3/4 DDoS attacks (requires Exclusive IP) |
| Attack Logs | View details of every request that triggered a security policy | Tracing request details (we recommend using Security Analysis for in-depth analysis) |
| Security Analysis | Perform in-depth analysis of all request traffic and attack events for a single hostname | Identifying abnormal traffic, tracing suspicious requests, analyzing attack events, evaluating protection effectiveness |
| Alert Management | Centrally manage security alert rules and their triggered historical events | Monitoring website security status in real time, reviewing historical alert events |
| L3/4 Banned IPs | View network-layer (L3/4) IP-blocking logs | Investigating false positives where legitimate users were blocked (requires Exclusive IP) |
Recommended Security Operations Practices
Security Incident Response
We recommend using Alert Management to monitor your business systems in real time, so that abnormal behavior or attack events are detected promptly.
- Go to the Alert Management page, enable predefined alerts with one click or configure custom alerts based on your business needs to ensure security events are monitored in real time.
- After receiving an alert notification, go to Security Analysis, filter by the corresponding time range, and analyze the traffic details or attack events.
- Identify the attack signature, take appropriate action, and add Custom Rules/Rate Limiting rules, or adjust policy parameters.
- After adjusting the configuration, return to Security Analysis and continue monitoring changes in request volume to confirm the protection effectiveness.
Routine Inspections (Daily/Weekly)
- Open Web Security Trends and check whether request trends are normal for the selected time range, and whether there is a spike in attack request volume.
- Check Top Attack Targets, identify the hostname with the highest number of attack requests, and go to Security Analysis to perform an in-depth analysis of that hostname.
- Check Top Rules Triggered, and pay particular attention to rules that are set to Log but have a high trigger volume — evaluate whether to switch them to Deny.
- Check Top Attack Sources, and consider adding an IP Blocking rule for IPs that persistently launch high-frequency attacks.
In-Depth Analysis of Abnormal Traffic and Security Events
We recommend using Security Analysis to perform in-depth tracing and analysis of a single hostname’s traffic or attack activity.
- Go to Security Analysis > Security Events to investigate the causes of false positives (legitimate requests blocked in error); or evaluate the effectiveness of your security policies and fine-tune them.
- Go to Security Analysis > Request Traffic to analyze the sources and behavior of suspicious traffic, and use the findings as a basis for creating new protection policies.
The Security Analysis feature is currently available to a limited set of users only. If you need access, contact technical support to request activation.
Is the content of this document helpful to you?
Yes
I have suggestion