Attacks
Attacks is the Panel screen for events Templass recorded against your protected service. The heading is Attacks, with the line Vectors, peak rates, and mitigation status for this service.
Open it during an incident and when you review the last burst.
Attack log
The table Attack log is edge telemetry for this prefix. Mitigated events stay in the log after the burst ends.
| Column | Meaning |
|---|---|
| Started | When Templass opened the event (local Panel timestamp) |
| Ended | When the burst ended |
| Vector | High-level classification (for example DNS amplification) |
| Peak | Peak rate shown for the event (Mbps and kpps when published) |
| Source | Region / reflector class and source ASN when published |
| Status | For example Mitigated |
If a column is empty, that field was not published for the event. Do not invent a PPS number or a named botnet.
Empty Attacks
An empty log can mean:
- You are not under attack, and nothing recent was stored
- The service is not provisioned, so there is nothing to record
- The attack is hitting an IP that is not the Templass-protected prefix
Empty Attacks plus a down service is a routing or DNS problem more often than "mitigation off". See Routing and Under attack.
During a live event
- Leave Attacks open. Note Started in UTC if you convert the stamp.
- Compare with Dashboard (Service window, Changes applying).
- Only then consider firewall or rate limiting.
- If the origin is down and Attacks is also empty, say that clearly in a Ticket.
After an event
Use Ended and Status to confirm the burst finished before you blame the application. If Attacks is quiet and users still fail, debug the origin (process, disk, application limits).
Templass staff may ask for a screenshot of Attacks. That is enough.