Docs

Type at least 2 letters.

    Live map

    The Requests Map follows WAF events from Enterprise zones in real time, with sources, cities, hosts and the live table.

    Updated View as Markdown

    The Ao Vivo (Live) screen shows the Mapa de Requisições (Requests Map): WAF events arriving in real time, shown on the map as lines converging on the location of your infrastructure.

    Where to find it

    In the side menu, go to Tráfego (Traffic) > Ao Vivo.

    The screen requires the map.read permission, which is not part of the default tenant roles. To enable it, contact Guardnet. Without it, the item does not show in the menu and direct access is denied. See Roles and permissions.

    Connect the stream

    The map does not connect automatically when the screen opens.

    1. Select Conectar (Connect).
    2. Advisor opens a live stream in Cloudflare: one Instant Logs job per Enterprise zone in the account.
    3. Wait for the Ao vivo (Live) status.

    If the connection is interrupted, select Reconectar (Reconnect).

    The connection status shows on screen: Aguardando (Waiting), Conectando… (Connecting…), Ao vivo (Live), Reconectando… (Reconnecting…), Sem conexão (No connection) or Parcial (Partial).

    Filter by WAF action

    The action filter sets which events show up:

    • Todos (All): shows every action. This option does not combine with the others.
    • Bloqueado (Blocked)
    • Desafio (Challenge)
    • Registrado (Logged)
    • Ignorado por regra (Skipped by rule)

    By default the screen opens with Bloqueado, Desafio and Registrado. With nothing selected, it shows Nenhuma ação selecionada (No action selected).

    Panels

    The IPs, Cidades (Cities), Hosts and Ao vivo buttons show or hide the panels:

    • IPs de origem (Source IPs)
    • Cidades (Cities)
    • Hosts
    • Ao vivo (Live): the event table, with the columns Hora (Time), País (Country), IP, Cidade (City), Método (Method), URI, Regra (Rule) and Ação (Action).

    Map origin

    The Origem do mapa (Map origin) is the point where attack lines converge. Enter the CEP (Brazilian postal code) of the protected infrastructure's location. With no CEP registered, the map uses Brasília as the origin.

    Changing the origin requires the map.write permission, which is not part of the default tenant roles. To enable it, contact Guardnet.