Skip to main content
Updates to the Live Traffic dashboard: attacker lead-time analysis, a threat origin map, per-IP drill-down, raw data access, and batch event ingestion.

​
Attacker Lead Time by Severity

A new heatmap cross-tabs every top attacker by severity against how long OneFirewall already knew about that IP before it reached you — from under an hour to over a year.
  • The Top Attacks table gains a Known By OFA column, showing how much lead time your Alliance membership gave you on each attacker (or — for an IP with no prior OneFirewall record).
  • This lets you see at a glance whether the attackers doing the most damage are ones the shared intel already flagged well in advance, or genuinely new actors.

​
Threat Origin World Map

The dashboard now includes a world map plotting where live attack traffic is originating from, alongside the lead-time heatmap and the existing device breakdown chart — all three now share one row (30% / 40% / 30%).

​
IP Intel Drill-Down

Clicking an IP anywhere in the Live Traffic tables now opens a Threat Actor modal with:
  • Full crime-score history chart for that IP
  • A connections table scoped to your organization — click any row to highlight the matching point on the score chart above
  • A link through to the IP’s full intel profile

​
Raw Data Debug View

A new Raw Data button opens the latest 10 unfiltered documents for your organization straight from the index — no field remapping or aggregation — so you can sanity-check what’s actually being ingested when a chart looks wrong. Backed by a new GET /api/v1/graphs/traffic/raw endpoint.

​
Data Health: Unrecognized Actions

Traffic where the action field doesn’t match any of your configured allow/deny values was previously excluded from both counters silently. The dashboard’s data health panel now surfaces these as an “Unrecognized action value(s)” warning, listing the offending values, so misconfigured action mappings are visible instead of quietly under-counted.

​
Batch Traffic Ingestion

POST to the live traffic endpoint now accepts either a single JSON document (unchanged) or an array of documents. Arrays are queued in-memory and drained one at a time by a FIFO worker, so bursts of events are processed in submission order without blocking the response — the endpoint replies immediately with {"message": "queued", "queued": N}. Auto-reported denied traffic can now also carry caller-supplied tags, merged with a fixed live_traffic tag on the resulting intel record.

​
Crime Score Capping

Crime scores are now consistently capped at 1000 everywhere they’re calculated or displayed — IPv4 lookups, live traffic scoring, and the domain/files/index/IPv6 tables — fixing a few places where a very fresh, high-confidence score could render above the intended maximum.

​
Also in this release

  • Dashboard risk badges, stat tiles, and severity table colors updated for better readability against the Defense Center attack chart.
  • The generated PDF report’s attack summary now includes the same world map / device breakdown shown on the dashboard.