1. On the Main tab, click Security > Reporting > DoS > Dashboard .
   The DoS Dashboard opens and displays real-time information about all DoS attacks on the system. The system displays information about attacks that either started or ended during the last hour, by default.
2. Review the charts to see if there have been any recent DoS attacks.
3. At the top of the screen, you can adjust the time frame and refresh details for the statistics.

   Option	Description
   Time frame	Specifies the time frame for which you want to display HTTP statistics (Last hour, Last day, Last week, and so on, or All to display all data).
   Auto-refresh interval	Controls how often the statistics are refreshed on the screen (1 min., 5 min., 10min., or turns refresh Off.
   Refresh button	Updates the statistics on the screen immediately.
   Timeline adjuster	Shows the actual time frame for which statistics are currently displayed according to the time focus that is selected. On the graphic, drag the handles on either end to change the focus of the statistics.

   As you adjust the time settings, the statistics are updated on the screen.
4. Initially, the data is unfiltered, and it displays all statistics it has for the time frame selected (Last hour, by default). To filter the data, select one or more dimensions in the right column.
   For example, you can filter by dimensions such as Attack IDs, Applications, Vectors, Countries, and so on. You can select more than one dimension, and one or more instances in a dimension. But note that some combinations are restricted.
   As you select dimensions or instances, the filtered statistics are displayed on the screen.
5. To view the statistics in table form, expand the dimension, then drag the handle on the dimensions column to the left.
   Tip: To see the full column names, hover over the headings. To expand the table to the full width of the screen to see all of the columns, click the handle.
   Tables containing detailed statistics for the items in the dimensions are displayed.
6. You can clear all filter selections or those for a dimension.
   • To clear all selections, click the gear icon at the top of the column and select Clear All.
   • To clear selections for a dimension, click the options icon (three horizontal lines to the left of the title), and select Clear Selection.

This figure shows a sample DoS Overview screen on a system that is having an attack.

The Overview screen includes information on throughput and RAM and CPU usage. Because the statistics vary from system to system, it is a good idea to become familiar with typical memory and CPU usage and throughput on your system as well as checking for recent attacks.

Sample DDoS Overview screen

Click the down arrow next to the protected object (in the Virtual Server column) to find out what type of attack it is. Here you can see the attack is a UDP flood attack.

Events related to an attack

1. On the Main tab, click Security > Event Logs > DoS .
   The DoS Application Events screen opens, and if Layer 7 DoS attacks were detected, it lists the details about the DoS attack such as the start and end times, how it was detected and mitigated, the attack ID, and so on.
2. If DoS attacks are listed, review the list of attacks to see what has occurred, when it occurred, the mitigation, and the severity of the attack.
3. From the event log, click the Attack ID link for an attack or event to display information about the attack in a graphical chart.
4. To view information about other types of DoS attacks, from the DoS menu, choose another event log to view:
   • For DNS DoS event logs, click DNS Protocol.
   • For SIP DoS event logs, click SIP Protocol.
   • For network firewall DoS event logs, click Network.
   • To view event logs if you are using Auto-Threshold Configuration and have selected Log Auto Threshold Events, click Auto Threshold.
   Many of the vectors set using device configuration, or when creating a protected object, include a setting for Auto-Threshold Configuration. You can log the auto-threshold events to see what values the system is setting based on the traffic it is handling.

1. On the Main tab, click Security > Event Logs > DoS > Application Events .
   The DoS Application Events screen opens, and if Layer 7 DoS attacks were detected, it lists the details about the DoS attack such as the start and end times, how it was detected and mitigated, the attack ID, and so on.
2. If DoS attacks are listed, review the list of attacks to see what has occurred, when it occurred, the mitigation, and the severity of the attack.
3. From the event log, click the Attack ID link for an attack or event to display information about the attack in a graphical chart.

1. On the Main tab, click Security > Reporting > DoS > Application > Transaction Outcomes .
   The Transaction Outcomes screen opens and displays a graphical chart showing cumulative statistics about DoS attacks detected by the system.
2. If you want to change the time frame for information shown in the chart, adjust the Display .. during settings.
   You can focus in on requests or responses only, and for the period of time you are interested in.
3. To see the statistics for a specific time, point anywhere on the chart.
   Information about the transactions at that time pops up on the screen.
4. If you want to view additional information, under the chart, from Drilldown to select the option for the details you want to see.
   For example, select Client IP Addresses to see the list of IP addresses involved in the attack, the number of transactions initiated by each one, and those which were valid, mitigated, and blocked.
5. To view a report showing live traffic, click Open Real-Time Charts.
   A popup screen shows DoS statistics in real-time, and it is updated every 10 seconds.

1. On the Main tab, click Security > Reporting > DoS > Application > Custom Page .
   The DoS Custom Page screen opens, and shows default widgets (sections) you may find useful.
2. Review the charts and tables provided, and click the configuration icon to adjust or delete them, as needed.
   • To modify the widget and change what it displays, click the gear icon and select Settings. On the popup screen, adjust the values that control what is displayed.
   • To remove the widget from the custom page, click the gear icon and select Delete.
3. To create a new widget to your specifications, click Add Widget.
   The Add New Widget popup screen opens where you can select custom options for what to include, the time frame, and how to display the information.
4. Continue adjusting the custom page so that it shows the information you want.
   You can drag and drop the widgets to change the order in which they are displayed. You can set the time range for all widgets or for each one separately.
5. To save the information shown in the custom report to a file or email attachment, click Export and choose your options.
   You can also export the data from a single widget by selecting Export from the configuration icon.