> ## Documentation Index
> Fetch the complete documentation index at: https://docs.recon44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Live Threat Feed: Real-Time Attack Visibility

> See every attack against your site as it happens — attack type, source IP, country, and whether Recon44 blocked, mitigated, throttled, or logged it.

The Live Threat Feed is the central view in your Recon44 dashboard. It displays every request that triggered a WAF rule or IP-based detection as it occurs, giving you a live view of who is attacking your site and what Recon44 did about it. You do not need to refresh — entries stream in automatically.

## What each entry shows

Every entry in the Threat Feed contains the following fields:

| Field           | Description                                                                          |
| --------------- | ------------------------------------------------------------------------------------ |
| **Time**        | Timestamp of the request, shown in your local timezone.                              |
| **Attack type** | The category of threat detected (see below).                                         |
| **Source IP**   | The IP address the request originated from.                                          |
| **Country**     | The country associated with the source IP via geo-lookup.                            |
| **Action**      | What Recon44 did with the request: `blocked`, `mitigated`, `throttled`, or `logged`. |
| **Rule ID**     | The WAF rule that matched, if applicable (e.g., `WAF-SQLI-01`).                      |

Click any entry to expand it and see the full request path, matched rule details, and options to block or whitelist the source IP.

## Attack types in the feed

<CardGroup cols={2}>
  <Card title="SQL Injection" icon="database">
    A request matched one or more SQL injection signatures in the query string, request body, or headers.
  </Card>

  <Card title="XSS Attack" icon="code">
    A cross-site scripting payload was detected in the request — typically in a form field or URL parameter.
  </Card>

  <Card title="DDoS Surge" icon="wave-square">
    A volumetric spike from one or more source IPs exceeded normal traffic thresholds. The surge is absorbed at the edge.
  </Card>

  <Card title="Brute Force" icon="key">
    Repeated login attempts from the same IP or IP range triggered rate-limiting rules.
  </Card>

  <Card title="Scanner" icon="magnifying-glass">
    Automated reconnaissance activity — port scanning, directory enumeration, or vulnerability probing.
  </Card>
</CardGroup>

## Action states explained

The **Action** column tells you exactly what happened to the request. The meaning of each action is consistent across all entries, but which actions appear depends on your plan.

<AccordionGroup>
  <Accordion title="Blocked">
    **Blocked** means the request was rejected at the edge and never forwarded to your origin server. The source IP was added to the active blocklist for the session.

    * The attacker receives no response (connection is dropped) or a generic error response — they get no information about why they were blocked.
    * Blocked entries include the WAF rule ID or the IP rule that triggered the block.
    * Blocked is the primary action on **Pro, Business, Scale, and Enterprise** plans when the WAF is in active blocking mode.
  </Accordion>

  <Accordion title="Mitigated">
    **Mitigated** means the attack was neutralized but may have received a response. This action applies primarily to DDoS surges: volumetric traffic is absorbed and rate-shaped at the edge, and legitimate requests from the same IP range may be allowed through at a reduced rate.

    * Mitigated is common for DDoS events where the source is a large IP range (e.g., a botnet), making an outright block impractical without collateral impact on legitimate users.
    * The attack volume is absorbed across Recon44's edge network before it can saturate your origin's bandwidth.
  </Accordion>

  <Accordion title="Throttled">
    **Throttled** means the source IP exceeded a rate limit and subsequent requests from that IP are being deliberately slowed. The IP has not been fully blocked; it can still reach your site but at a controlled request rate.

    * Throttled is the primary response to **brute force** and **credential stuffing** patterns.
    * If the suspicious pattern continues after throttling, Recon44 automatically escalates to a full block.
    * Throttled traffic still reaches your origin at the reduced rate. If you want to stop it entirely, manually block the IP from the feed.
  </Accordion>

  <Accordion title="Logged">
    **Logged** means the request matched a rule or detection pattern, but no blocking or throttling action was taken. The request was passed through to your origin and the event was recorded for your review.

    * Logged is the only action available on the **Free plan**, where the WAF runs in read-only mode.
    * On paid plans, logged entries typically represent events that matched a lower-confidence rule that is configured to observe rather than block.
    * Use logged entries to identify patterns you want to manually block or to investigate whether a rule is generating false positives.
  </Accordion>
</AccordionGroup>

<Info>
  On the Free plan, all actions appear as **Logged**. Upgrading to Pro or above enables active blocking, which changes the action on matched requests to **Blocked**.
</Info>

## How to read and act on the feed

<Steps>
  <Step title="Identify high-frequency sources">
    Sort the feed by **Source IP** to spot IPs generating large numbers of events. A single IP with dozens of entries in a short window is likely a scanner or brute-force bot.
  </Step>

  <Step title="Check the attack type and rule ID">
    Expand an entry to see which rule matched. If you see `WAF-SQLI-01` or `WAF-XSS-01`, a specific exploit is being attempted. If you see repeated `Scanner` entries, someone is probing your site for vulnerabilities.
  </Step>

  <Step title="Block or whitelist in one click">
    From any expanded entry, click **Block IP** to immediately add the source to your blocklist, or **Whitelist IP** if the entry is a false positive from a trusted source (a monitoring service, your own infrastructure, etc.).
  </Step>

  <Step title="Filter by attack type or action">
    Use the filter bar at the top of the feed to narrow to a specific attack type (e.g., show only DDoS Surge events) or a specific action (e.g., show only Logged entries you haven't reviewed). Filters apply in real time.
  </Step>
</Steps>

<Tip>
  If you see a sudden spike of **DDoS Surge** entries, check the **Country** column. Geo-blocking an entire region can stop a volumetric attack at the source. See [Geo and ASN blocking](/concepts/ip-blocking#geo-and-asn-blocking) for how to do this in one click.
</Tip>

## Feed retention

<Tabs>
  <Tab title="Free plan">
    The Threat Feed retains the last **24 hours** of events. Older entries are not accessible from the dashboard.
  </Tab>

  <Tab title="Pro plan">
    The Threat Feed retains the last **7 days** of events, searchable and filterable from the dashboard.
  </Tab>

  <Tab title="Business & above">
    The Threat Feed retains the last **90 days** of events. Full event data is also available in **Audit Logs** for export and compliance purposes. See [Audit Logs](/guides/audit-logs) for details.
  </Tab>
</Tabs>

## Related pages

<CardGroup cols={2}>
  <Card title="WAF — How It Works" icon="shield-halved" href="/concepts/waf">
    Understand the rules behind the attack types you see in the feed.
  </Card>

  <Card title="IP Blocking" icon="ban" href="/concepts/ip-blocking">
    Block or whitelist IPs, and set up geo and ASN rules to stop attacks at the source.
  </Card>
</CardGroup>