> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/administration/account/interface/alarming.md).
# Alarming
The Alarming Service sends alert messages to customers regarding specific types of traffic events. Its primary use is to alert customers about attack traffic with the option to customize details of the alarm.
***
### Add Rule
Will redirect to the following page where rules can be added
| Setting | Description |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Name | Personalized name for this alarm |
| Turn off notifications | Disables broadcasting of all notifications |
| Alarming Events | Enables events (WebDDoS attack, Network DDoS attack based on filter detection, suspicious traffic based on Netflow) that triggers an alarm |
| Select Instances | By default, alarms are off for all instances. If this setting is enabled, an admin can choose for which Instance alarming gets triggered |
{% hint style="info" %}
Suspicious Traffic events aren’t DDoS attacks, because no mitigation or blocking are involved.
{% endhint %}
***
### **Add Contact**
Clicking on the Add Contact option opens a form (multiple contacts can be set for one alarming rule):
Here specific notification methods can be disabled, without disabling the entire alarming rule.
The Email Attack Report is an automatically generated PDF, and is the same as the ones that are available later in the WebGUI.
{% hint style="warning" %}
To finalize adding a rule, do not forget to click the ‘Add Rule’ button.
{% endhint %}
***
### Alarming Templates
There are different message templates for each event according to the status (starting, ongoing, ending). These templates can be edited to contain different messages, and will be sent out if alarming rules get triggered.
***
### Notification History
In the notification history you can see date (and time), Event, Instance, Communication Method, Type, Message and Status of an Alarm Notification.
***
### Communication Methods
Alerts can be sent over three different communication channels
* Email
* SMS
* JSON Webhooks
**JSON Webhook example:**
```
subject,message
Web DDoS Attack Ended ({{ attack_id }}),"The attack {{ attack_id }} against {{ attack_domain }} (DDoS proxy IP: {{ proxy_ip }}) has ended.
Duration: {{ attack_duration }}
Blocked IPs: {{ blocked_ips }}
ReCAPTCHAs started: {{ recaptchas_started }}
ReCAPTCHAs validated: {{ recaptchas_validated }}
ReCAPTCHAs failed: {{ recaptchas_failed }}
ReCAPTCHAs unanswered: {{ recaptchas_unanswered }}
Requests in total over attack period: {{ number_of_requests }}
SSL requests in total over attack period: {{ number_of_ssl_requests }}"
Network DDoS Attack ({{ attacked_network }}),A Network DDoS attack targeting {{ attacked_ips }} starting at {{ start_time }} has been detected.
Network DDoS Attack Ongoing ({{ attacked_network }}),"Ongoing attack against {{ attacked_ips }}
Time elapsed: {{ attack_duration }}
Number of filters triggered by this attack: {{ attack_number_of_filters }}"
Network DDoS Attack Update ({{ attacked_network }}),"Ongoing attack against {{ attacked_ips }}
Time elapsed: {{ attack_duration }}
Number of filters triggered by this attack: {{ attack_number_of_filters }}"
Network DDoS Attack Ended ({{ attacked_network }}),"The attack targeting {{ attacked_ips }} has ended.
Start Time: {{ start_time }}
Duration: {{ attack_duration }}
Filter(s) triggered (count): {{ attack_number_of_filters }}"
Suspicious Traffic Event Alert ({{ attacked_network }}),"A Suspicious Traffic Event targeting {{ attacked_ips }} has been detected.
Start Time: {{ start_time }}
Current Bandwidth: {{ bandwidth }} Mbps"
Suspicious Traffic Event Ongoing ({{ attacked_network }}),"Ongoing Suspicious Traffic Event targeting {{ attacked_ips }}
Time elapsed: {{ attack_duration }}
Current Bandwidth: {{ bandwidth }} Mbps"
Suspicious Traffic Event Ongoing ({{ attacked_network }}),"Ongoing Suspicious Traffic Event targeting {{ attacked_ips }}
Time elapsed: {{ attack_duration }}
Current Bandwidth: {{ bandwidth }} Mbps"
Suspicious Traffic Event Ended ({{ attacked_network }}),"Suspicious Traffic Event targeting {{ attacked_ips }} has ended.
Start Time: {{ start_time }}
Duration: {{ attack_duration }}
Current Bandwidth: {{ bandwidth }} Mbps"
Web DDoS Attack Alert ({{ attack_id }}),"A Web DDoS attack targeting {{ attack_domain }} (DDoS proxy IP: {{ proxy_ip }}) has been detected.
Start Time: {{ start_time }}"
Web DDoS Attack Ongoing ({{ attack_id }}),"Ongoing attack against {{ attack_domain }} (DDoS proxy IP: {{ proxy_ip }})
Time elapsed: {{ attack_duration }}
Blocked IPs: {{ blocked_ips }}
ReCAPTCHAs started: {{ recaptchas_started }}
ReCAPTCHAs validated: {{ recaptchas_validated }}
ReCAPTCHAs failed: {{ recaptchas_failed }}
ReCAPTCHAs unanswered: {{ recaptchas_unanswered }}
Requests in total over attack period: {{ number_of_requests }}
SSL requests in total over attack period: {{ number_of_ssl_requests }}"
Web DDoS Attack Ongoing ({{ attack_id }}),"Ongoing attack against {{ attack_domain }} (DDoS proxy IP: {{ proxy_ip }})
Time elapsed: {{ attack_duration }}
Blocked IPs: {{ blocked_ips }}
ReCAPTCHAs started: {{ recaptchas_started }}
ReCAPTCHAs validated: {{ recaptchas_validated }}
ReCAPTCHAs failed: {{ recaptchas_failed }}
ReCAPTCHAs unanswered: {{ recaptchas_unanswered }}
Requests in total over attack period: {{ number_of_requests }}
SSL requests in total over attack period: {{ number_of_ssl_requests }}"
```
### **Additional note**:
When attacks occur, our system acts quickly to mitigate them. We have algorithms which measure peak traffic in real time, and correlate them with the past 15 seconds. If there is a threat pattern detected, the system starts to act.
The alarming reports are based on 60-second average periods of time. Therefore, if the attack had a very short peak, the 60 second average can be less than the real time filter data, especially for short attacks/spikes/peaks in traffic.