How Detectors Work

How detection works

Every detector compares a current window of traffic against a baseline (either your own recent history or a fixed threshold) and opens an alert when the two diverge by more than the configured amount. Three things keep this honest:

• Volume floors scale to your traffic. Thresholds are tuned against a large reference storefront, and each source calibrates the floors down proportionally to its own size. A smaller site does not need reference-scale volume before detectors will fire.
• Baselines never include the spike. The comparison window is always prior, non-overlapping history, so a sustained attack cannot dilute its own baseline.
• Warmup. New sources are suppressed for the first hour (fast detectors) to six hours (hourly detectors) so the initial backfill burst does not create false alarms.

Some detectors ship disabled. These are high-power, higher-tuning-risk detectors that you should validate against your own traffic shape first: review the thresholds on the Rules page, then toggle them on. Nothing about a disabled detector costs you anything; it simply does not evaluate.

Every minute

Detector	What it catches	Default
ASN Spike	One network suddenly sending many times its own normal rate, compared within the same country and tuned per network type (datacentre fires at 3x, residential ISPs at 15x)	On
499 Rate	The scraper signature: a network whose clients keep hanging up before the response finishes	On
Cache Bypass	A network whose requests dodge your cache at an abnormal rate, hammering origin	On
Origin Latency Spike	A path whose origin response time jumps against its own baseline. This one wakes the dev team, not the WAF operator: DB locks, slow dependencies, bad deploys	On
Path Traffic Spike	One URL's traffic surging while spread across many networks: card testing, credential stuffing, drop bots	Off until tuned
IP Fan-out	Many distinct IPs from one network each hitting the same path a modest amount, the pattern that hides from both ASN and IP volume checks	Off until tuned
Method Shift	A surge of failing POSTs on one path from one network: the credential-abuse and enumeration signature	Off until tuned
Distributed Path Abuse	Credential abuse spread across many networks at once so no single network stands out	Off until tuned
Inventory Hoarding Velocity	Scalping: add-to-cart velocity out of proportion to browsing	Off until tuned
Search Abuse Velocity	Search-endpoint flooding, which inflates search analytics and origin load	Off until tuned
UA Rotation	A network cycling through an implausible number of browser versions	Off until tuned

Hourly

Detector	What it catches	Default
Slow Burn	Gradual escalation over weeks: volume up, 499s up, cache hits down. Compares 7 days against the prior 28	On
Bot Score	A network whose traffic is predominantly scored as automated AND is actually hitting origin rather than being served from cache	On
TLS Weak Protocol	Traffic on deprecated TLS 1.0/1.1: misconfigured scrapers, legacy integrations, compliance risk	On
Path Entropy	Systematic catalogue crawling: requests spread evenly across every URL instead of clustering on popular pages	On
Challenge Solving	Post-mitigation evasion: a previously challenged network whose solve rate suddenly improves	On
Probe / Scanner	Reconnaissance: many distinct probe paths (WordPress kits, secrets hunters, admin panels) from one network, including probes that use your brand name	On
ASN Recurrence	The repeat offender: a network that keeps tripping alerts across days and weeks, even though each individual alert resolved	On
Stale Browser Anomaly	Meaningful volume claiming to be a browser version that real users abandoned long ago (warning-only)	On
Verified Bot Impersonation	Traffic claiming to be Googlebot or another known crawler that fails verification	On
AI Agent Traffic	AI agents attempting transactions (POST requests) on your storefront	On

Every six hours

Certificate checks. Edge probes every monitored domain for expiry and certificate changes. See Certificate Monitoring.

Continuous

Source Silence. Watches every source's ingest heartbeat and pages you when the data feed itself stops, so a silent Logpush outage cannot masquerade as a quiet day. See Source Silence Detector.

Availability monitoring

Uptime. The one detector that does not read your traffic logs. It checks the URLs and checkout journeys you add from the outside on a schedule, or lets your own app report each transaction, and opens an alert when a page or a step stops responding. It debounces before it pages you (three failures by default) so a single blip stays quiet, and it correlates into incidents like every other detector. See Uptime and journey monitoring.

When several detectors agree

One real attack usually trips more than one detector. Edge groups alerts that share a target into a single incident with a confidence score, so you investigate once. See Correlated Incidents.

Tuning

Every threshold is editable per rule on the Rules page, and rules that depend on a specific Logpush field tell you when that field is missing from your job. For expected surges (sales, drops, launches) do not loosen thresholds: declare a campaign window instead.