Skip to main content
The Analytics section of the Flarehawk dashboard gives you a detailed, time-based view of your traffic and security posture. Rather than reacting to individual alerts, analytics lets you spot patterns — sustained traffic growth, emerging geographic threats, high-frequency WAF rule hits — and understand what normal looks like for your assets. Navigate to Analytics in the sidebar to get started.

​
Selecting a time range

A time range selector at the top of the Analytics page controls the window for every chart on the page. The available preset ranges are: You can also set a custom start and end date for any range up to 366 days. The dashboard automatically adjusts chart granularity — shorter ranges use per-minute or per-5-minute buckets; longer ranges use hourly or daily buckets — so charts remain readable at any scale.

​
Per-domain filtering

If you have more than one connected asset, a domain selector at the top of the page lets you filter all charts to a single connection. Select a specific domain to see its metrics in isolation, or leave it set to All assets for an aggregated view across your entire account.

​
Time-series charts

The main analytics view includes several time-series charts that plot metrics over your selected time range:
Shows the total number of HTTP log events ingested per time bucket — effectively your requests per minute (or per hour for longer ranges). Use this chart to spot traffic spikes, DDoS patterns, or unexpected drops that might indicate an ingest issue.
Plots the percentage of requests returning 4xx and 5xx status codes over time. A sudden increase in 5xx errors often correlates with an attack or infrastructure problem. A spike in 4xx errors may indicate scanning or credential stuffing activity.
Shows blocked, challenged, and flagged WAF requests over time, alongside the average WAF threat score and hit counts for firewall rules and managed rules. Use this chart to understand when your WAF is most active and whether action rates are trending up.
Shows average, p50, p90, and p99 time-to-first-byte in milliseconds. Performance degradation often accompanies attacks — correlating TTFB spikes with traffic anomalies can help you distinguish load-related slowdowns from attack-induced ones.
An hourly composite of malicious requests, suspicious IPs, SQL injection signals, XSS signals, and remote code execution signals. Use this chart alongside alert data to understand the overall attack surface during a time window.

​
Top IPs by request volume

A ranked table of the IP addresses generating the most requests during the selected time range. Each row shows:
  • IP address
  • Total request count
  • Error count and error rate
  • Average TTFB
High request counts from a single IP — especially combined with high error rates — are a strong signal for scanning, credential stuffing, or a bot. You can use an IP from this table as a filter in the Logs section to drill into the raw requests.

​
Top paths by request volume

A ranked table of the URL paths receiving the most traffic during the selected time range. Each row shows:
  • Path and HTTP method
  • Request count
  • Error count and error rate
  • Average TTFB and average response size
Use this table to identify which endpoints are being targeted most heavily, and to spot paths with unusually high error rates that might indicate exploitation attempts.

​
Geographic distribution

A breakdown of request volume by country, including:
  • Request count per country
  • Error rate per country
  • Average TTFB per country
  • Bot request count and bot rate
  • Total bandwidth served
The geographic table is useful for identifying traffic from unexpected regions, assessing whether geographic blocking would reduce noise, and understanding where latency is highest.

​
Top user agents

Bot activity data groups traffic by bot category and plots bot request counts and average bot scores over time. This helps you distinguish legitimate crawlers (e.g., search engine bots) from automated attack tools.

​
WAF rule hit counts

A table of the WAF rules that fired most frequently during the selected time range, showing: A rule with a high trigger count from many unique IPs usually indicates a broad scanning campaign. A high trigger count from a small number of IPs may be targeted probing.

​
Cache performance

Shows cache hit rate, miss rate, and bytes saved over time. A declining cache hit rate may indicate that attackers are bypassing your cache by randomizing query strings or paths, which also increases your origin load.

​
Device analytics

A breakdown of traffic by device type (desktop, mobile, tablet, bot, etc.), including the most common OS and browser per device category, average response size, and error rate. This view helps you understand whether a traffic spike is coming from real users or from automated clients.