Monitoring signals

The Account overview dashboard gives you access to the Top signals view. The Top signals view helps you get a high-level view of the signals your requests are tagged with.

To access the Top signals view:

1. Log in to the Fastly control panel.
2. Go to Security > Next-Gen WAF > Dashboards.
3. From the workspaces bar, click the menu to the right of the workspace name and select your account name.

The Top signals view contains the following tabs:

• Attack signals: data related to malicious requests.
• Anomaly signals: data related to abnormal requests (e.g., requests containing malformed data and requests originating from known scanners).
• Account signals: data related to signals created at the account level.

You can use the Top Signals section of the Corp Overview page to monitor top signals for a corp. To monitor corp signals, click the name of your corp in the upper left corner of the control panel to navigate to the Corp Overview page. The Top Signals section surfaces signal data from your corp in the following tables:

• Attack Signals: displays data related to malicious requests.
• Anomaly Signals: displays data related to abnormal requests (e.g., requests containing malformed data and requests originating from known scanners).
• Corp Signals: displays data related to signals created at the corp level.

You can use a search bar to filter the tables by signal. The tables contain the following columns:

• Signal: the name of the signal.
• Total Requests: the number of requests that were tagged with the signal in your corp.
• Top sites: the sites that had the highest number of requests with that signal.
• Requests per Site: the number of requests tagged with that signal per site.

To view a summary of the activity related to a signal:

1. Log in to the Fastly control panel.
2. Go to Security > Next-Gen WAF > Signals.
3. From the workspaces bar, click the menu to the right of the workspace name and select a workspace.

4. Use the tabs, search bar, and filter menus to find the appropriate signal. Tab options include:

   • All: lists all signals.
   • System: lists all system signals.
   • Configurable: lists all system signals that you can configure.
   • Virtual Patches: lists all virtual patch signals.
   • Custom: lists all custom signals.

5. Click the name of the signal. A summary of the activity related to that signal appears.

The summary includes the following:

• the number of requests tagged with the signal over time.
• a list of sources (e.g., IP addresses) that were flagged because they exceeded thresholds related to the signal.
• a list of requests that were tagged with the signal.

The Signals Dashboard page lets you view charts that display time series data for all signals for a specific site. To access the Signals Dashboard page:

1. Log in to the Next-Gen WAF control panel.
2. From the Sites menu, select a site if you have more than one site.

3. From the Monitor menu, select Signals Dashboard.

4. (Optional) Click the name of a signal to view a summary of the activity related to that signal.

   When a signal acts as the threshold signal for an advanced rate limiting rule, the summary page includes a chart that shows two key metrics: the number of requests tagged with the threshold signal and the total number of requests that were rate limited. Because the total number of rate limited requests already counts requests tagged with the threshold signal, these numbers should not be added together. For example, if both the threshold signal count and the rate limit count are 1, the request tagged with the threshold signal was the one that was rate limited. However, the counts may not be the same if the rule rate limits all requests from clients exceeding the threshold. For example, if approximately 38,000 requests were tagged with the threshold signal and 82,000 requests were rate limited, nearly all requests tagged with the threshold signal were rate limited, and approximately 44,000 other requests were rate limited.