Understanding the Overview Dashboard

Headline tiles

The four tiles at the top show:

• Total Requests -- all HTTP requests in the selected time window
• Egress Bytes -- total bytes sent to clients
• Cache Hit Ratio -- percentage of requests served from cache. The sublabel adapts to your traffic profile: for SFCC sites where dynamic traffic exceeds 40%, the sublabel reads "SFCC typical: 35-55%" instead of a generic target. This auto-detection prevents false concern when storefront pages are dynamic by design.
• 499 Ratio -- percentage of requests where the client closed the connection before the edge finished responding (healthy: <1%)

If your Logpush job is missing the bot-score field, a banner appears here explaining which detectors are inactive and which field to add. See HTTP Methods and Required Logpush Fields.

World map

Below the headline tiles, a world map shows traffic volume by client country using an orange heat scale.

• Hover over any country to see the country name, total requests, and percentage of overall traffic
• Click a country to open the Offenders page filtered by that country ("Traffic from", based on where requests originate, not where the network is headquartered)
• Alert overlay — a toggle switches the map to highlight countries with open alerts, so "where is trouble coming from right now" is one glance

Requests over time

The timeseries chart shows requests stacked by status class (2xx, 499, 3xx, 4xx, 5xx) over the selected range. A sudden spike in 499s or a change in the status mix is the first visual indicator of an attack.

Above the chart, the Markers control overlays your open alerts and open incidents onto the timeline, each pinned to the moment it opened, so you can see a spike and what fired against it in one view. Two toggles, Open alerts and Incidents, turn each layer on or off, and the choice is remembered on this browser. A marker sits where its alert or incident was raised, so anything older than the visible range simply falls off the left of the chart.

Ranked lists

Three bar-behind-label lists sit below the chart. Each row shows a label, a proportional bar, a count, and a percentage.

Edge Status Codes

Colour-coded by class: green for 2xx, blue for 3xx, amber for 4xx, red for 499 and 5xx. Click any row to open the Offenders page filtered by that status class.

Data Centres

Shows city names inline (e.g. "LHR · London"). The top 10 are shown by default with a "Show all" toggle. A sudden shift (e.g. SIN appearing at the top when your customers are in the US/EU) can indicate geo-targeted scraping.

Cache Statuses

Each cache status row has a hover tooltip explaining what that status means (hit, dynamic, miss, etc.). Click any row to open the Offenders page filtered by that cache status.

What tag analytics never sees

Tag analytics (Adobe, GA4) observes JavaScript-executing, consented browsers — and nothing else. This card splits your traffic against that reality: the red slice could never have fired a tag (API clients and scripts, declared bots and crawlers, requests with no usable user agent), and the last tile shows the opposite problem — traffic that is browser-shaped but bot-scored, which does fire tags and quietly pollutes your reports.

Every number on the card drills. Click the headline percentage to open the whole never-tagged slice, or click a tile for just that segment. The drill shows three things side by side:

• Where it came from — the networks behind the segment, each with its share, clicking through to the network's detail page.
• What it hit — the segment's top paths, with POST and error counts. A code-shaped segment POSTing at cart or login endpoints deserves attention; reading product pages usually doesn't.
• What it claimed to be — the claimed identity (curl, python-requests, or a browser name and version). On the browser-shaped-but-bot-scored segment this column is the tell: most of the traffic concentrated on one browser version is the signature of an automated fleet, not a real audience.

The declared bots and crawlers tile links to the Bots & agents page instead, which is that population's full drill-down. The drill always uses the same definitions as the card itself, so what you expand sums to the number you clicked.

Active alerts

Shows the top 5 open alerts with a severity badge (info, warning, critical). Click "View all" for the full Alerts page.

Your week in traffic

At the bottom of the Overview, the weekly comparison puts this week against last week and the same week a year ago, with a 52-week trend strip and an AI-written digest of what changed. See Your Week in Traffic.