Attack traffic can create a lot of noise. Incidents represent the signal.

An incident is an attack that hit a real security issue in your application and got a response proving it worked. The new Incidents page puts that signal in the same interface you already use for Attacks. The attacks that matter most now get the same investigation flow as everything else.

There's nothing to install and nothing to migrate. The new page shows up in your dashboard automatically.

Only confirmed incidents appear here. If it's on this list, it got through.

What's new

A dashboard for what got through
See requests with incidents over time. Alongside the chart you get the top source IPs, endpoints, hosts, attack types and subtypes behind them, plus a breakdown of the response codes your application sent back.

A month of incidents, and who and what was behind them.

Grouped the way you investigate
Incidents are grouped by attack type, then HTTP method, domain, path, and the parameter the payload landed in. Open any level to drill down, all the way to individual requests.

The exact attack that became the incident
One request can carry several attack payloads, and usually only some of them hit a vulnerability. The request details now mark the one that raised the incident, so you don't have to guess which payload did the damage.

One incident, 120 requests, and the RCE payload flagged with the vulnerability it exploited.

Severity on every row
The Security Issues column shows the severity and state of each linked issue. If something is critical and still open, you'll see it without clicking in.

Shareable views
Your filters and time range live in the page address. Reload, bookmark, or drop the link in a ticket, and the same view opens for whoever clicks it.

Export
Export the incidents in your current view, filters included, for incident response or reporting.

Links into Incidents from the Threat Prevention dashboard and from Security Issues now open the new page.

Your detection and your security issues haven't changed. What's changed is how fast you get from "something got through" to the exact request that did it.

Learn more in the Incidents documentation.