> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# v2026-08-18 - Live Traffic

> The Live Traffic dashboard gains attacker lead-time analysis, a threat origin map, drill-down IP intel, and batch ingestion

Updates to the **Live Traffic dashboard**: attacker lead-time analysis, a threat origin map, per-IP drill-down, raw data access, and batch event ingestion.

***

## Attacker Lead Time by Severity

A new heatmap cross-tabs every top attacker by severity against how long OneFirewall already knew about that IP before it reached you — from under an hour to over a year.

* The **Top Attacks** table gains a **Known By OFA** column, showing how much lead time your Alliance membership gave you on each attacker (or `—` for an IP with no prior OneFirewall record).
* This lets you see at a glance whether the attackers doing the most damage are ones the shared intel already flagged well in advance, or genuinely new actors.

## Threat Origin World Map

The dashboard now includes a world map plotting where live attack traffic is originating from, alongside the lead-time heatmap and the existing device breakdown chart — all three now share one row (30% / 40% / 30%).

## IP Intel Drill-Down

Clicking an IP anywhere in the Live Traffic tables now opens a **Threat Actor** modal with:

* Full crime-score history chart for that IP
* A connections table scoped to your organization — click any row to highlight the matching point on the score chart above
* A link through to the IP's full intel profile

## Raw Data Debug View

A new **Raw Data** button opens the latest 10 unfiltered documents for your organization straight from the index — no field remapping or aggregation — so you can sanity-check what's actually being ingested when a chart looks wrong. Backed by a new `GET /api/v1/graphs/traffic/raw` endpoint.

## Data Health: Unrecognized Actions

Traffic where the `action` field doesn't match any of your configured allow/deny values was previously excluded from both counters silently. The dashboard's data health panel now surfaces these as an **"Unrecognized action value(s)"** warning, listing the offending values, so misconfigured action mappings are visible instead of quietly under-counted.

## Batch Traffic Ingestion

`POST` to the live traffic endpoint now accepts either a single JSON document (unchanged) or an **array of documents**. Arrays are queued in-memory and drained one at a time by a FIFO worker, so bursts of events are processed in submission order without blocking the response — the endpoint replies immediately with `{"message": "queued", "queued": N}`.

Auto-reported denied traffic can now also carry caller-supplied **tags**, merged with a fixed `live_traffic` tag on the resulting intel record.

## Crime Score Capping

Crime scores are now consistently capped at **1000** everywhere they're calculated or displayed — IPv4 lookups, live traffic scoring, and the domain/files/index/IPv6 tables — fixing a few places where a very fresh, high-confidence score could render above the intended maximum.

## Also in this release

* Dashboard risk badges, stat tiles, and severity table colors updated for better readability against the Defense Center attack chart.
* The generated PDF report's attack summary now includes the same world map / device breakdown shown on the dashboard.