How-to
The Activity Timing Heatmap
A week-by-hour heatmap of when automated traffic hits you, with drill-down into any hour slot.
Jump to section
What it shows
Open Alerts and switch to the Timing view. You get a heatmap of the week: seven days across, 24 hours down, each cell coloured by activity in that local-time slot.
The default view is Automated, the share of traffic in each slot that looks automated, because that's the operationally interesting question. You can switch the metric to raw requests and other measures.
Why the pattern matters
Human retail traffic has a shape: it rises in the morning, peaks in the evening, dies at 3am. Automated traffic doesn't care. The heatmap makes the mismatch visible:
- Hot cells at 02:00–05:00 — scrapers and probes scheduled for your quiet hours, when nobody is watching dashboards
- A hot vertical stripe (same hour every day) — a scheduled job hammering you daily; often a misconfigured integration rather than an attack
- Weekend-only heat — activity timed for when your team is off
Drilling into a slot
Click any cell to see what actually happened in that slot: the alerts that opened in that hour of the week, so "Tuesdays at 3am are always hot" turns into "and here is what fired". From there, each alert links to its detail page as normal.
Which networks are behind it
On the Alerts metric, a Top networks by alerts panel below the heatmap ranks the ASNs driving the alerts in the current view: organisation name, total alert count, how many were critical, and how many different detectors each network has tripped. It respects the window and any detector chip you have selected, and narrows to a single cell when you click one, so "Fridays at 09:00 are hot" becomes "and it is mostly these two hosting providers". Each row links to that network's detail page, where the Suggest rule button drafts a response.
Alerts without a network dimension (path, source, and certificate alerts) are not attributed, so the panel's total can be smaller than the heatmap's.
How to use it
- Check it after enabling new detectors: the heatmap shows when they fire, which helps you judge whether a threshold is catching a nightly job or real attacks.
- Use quiet-hours heat to justify challenge rules: traffic at 3am from datacentre networks costs a false positive almost nothing.
- If a slot is persistently hot, check ASN Recurrence alerts — a scheduled attacker is usually also a repeat offender.