Traffic analytics
See every attack, down to the flow.
Orbitel Shield shows what arrives for each of your prefixes, what the edge dropped and why, as it happens. Every attack is kept with its peak, its flows and the vectors it used.
- Live per-prefix telemetry
- Forensics for every attack
- Alerts and API included
Know what is happening right now.
Every prefix gets its own live view, built from the reports of every scrubbing node that carries it.
Offered, dropped and delivered
For every prefix: everything that arrived, everything the edge dropped and the clean traffic that reached you.
Peaks, not averages
Graphs plot the peak in every interval, so a ten-second burst still shows up in the 24-hour view.
Flows, not just totals
Flows seen and flows dropped show whether a flood comes from a handful of sources or a whole botnet.
Every node, added up
Each scrubbing node reports in, and the numbers you see add all of them together.
Under attack, at a glance
Each prefix shows whether it is under attack right now and how many attacks it has seen in the window.
Live, every ten seconds
The panel refreshes every ten seconds, over the last hour, the last six hours or the last day.
Forensics for every attack.
When something hits, you get more than a spike on a graph. Each attack is recorded as an event you can take apart.
Every vector, accounted for
Each attack lists the vectors it used and how much of it each one was, tied to the guard, rule or filtering stage that dropped it.
Pulse waves, flagged
Burst attacks are marked as pulse waves, so you can tell one attack that keeps coming back from a string of separate floods.
History that stays
Every attack goes into your attack history with its start, end, peak and vectors, to review later or pull from the API.
Alerts before anyone has to ask.
Your team hears about an attack when it starts, not when a customer calls.
Where your team already is
Email, Discord, Slack and webhooks, up to ten channels, each with the events it should hear about.
The events that matter
Attack started, attack ended, mitigation changed and tunnel down.
Signed webhooks
Every webhook carries an HMAC-SHA256 signature with a timestamp, so your systems can check it came from us.
Your data, in your own tools.
Everything in the panel is in the API too, so attacks can land in your own dashboards, tickets and on-call tools.
The same data as the panel
Traffic per prefix, time series, attacks with their vectors and the full attack history, as JSON.
Keys that only do their job
Give each key just the scopes it needs, limit it to your own addresses and set it to expire.
curl "$ORBITEL_API/protection/$SERVICE/analytics/events?window=24h" \
-H "Authorization: Bearer $ORBITEL_API_KEY"{
"events": {
"window": "24h",
"events": [
{
"prefix": "203.0.113.0/24",
"started_at": "2026-11-08T14:07:12Z",
"seconds": 277,
"peak_pps": 3104000,
"flows": 182400,
"pulse": true,
"vectors": [
{ "reflection": "dns", "flows": 120400, "dropped": 512340000 },
{ "syn_flood": "tcp", "flows": 30100, "dropped": 90770000 }
]
}
]
}
}At a glance.
- Windows
- The last hour, 6 hours or 24 hours
- Refresh
- Every 10 seconds in the panel
- Per prefix
- Offered, dropped, delivered and challenged traffic, flows and peaks
- Attack events
- Start, end, duration, peak, flows and vectors, with pulse waves flagged
- Alert channels
- Email, Discord, Slack and signed webhooks, up to 10
- Alert events
- Attack started, attack ended, mitigation changed, tunnel down
- API
- JSON over HTTPS, with scoped keys, IP allowlists and expiry
- Included
- With every plan, at no extra cost
Questions, answered.
Can’t find what you need? Talk to an engineer.
How fresh is the data?
Live. The panel refreshes every ten seconds, and an attack shows up while it is still going, not only once it has ended.
How far back can I look?
The traffic graphs cover the last hour, six hours or day. Every attack is also kept in your attack history, so you can look back further than that.
Can I get the data into my own monitoring?
Yes. The API returns the same traffic, attack and history data as the panel, as JSON, with keys you can scope, limit to your own addresses and set to expire.
Where can alerts go?
Email, Discord, Slack or any HTTPS webhook. Set up to ten channels and choose which events each one hears about.
Are analytics included in my plan?
Yes. Every plan includes live analytics, attack history, alerts and the API, at no extra cost.