Manage Alerts
All rate-limiting violations generated by the system are displayed on this Alerts screen. This screen provides administrators with complete visibility into suspicious or excessive request activity, helping them monitor system health and identify potential abuse patterns.
A listing is presented to display all captured alerts, and for each alert entry, it displays all essential information, including Created On, Name, IP Address, Service Name, Severity, Policy, and Details.
The Details section expands further to show complete request information, including endpoint details, request body (when applicable), User Agent, and IP Address. Suppressed counts, reflecting events grouped by Suppression Settings, are also shown here.
An Advanced Search option is provided to help administrators quickly locate specific incidents. Searches can be performed using parameters such as Service Name, IP Address, Severity, Policy, and Date/Time.
Rate Limiting Configuration
Rate limiting in the system is fully configurable through the appsettings.json file for both the Admin and Web environments. These settings allow administrators to define how incoming requests are controlled, monitored, and restricted to protect the platform from abuse, high traffic surges, or potential exploitation attempts.
Although the configuration structure remains consistent across both environments, the available policies differ slightly based on the system’s exposure and risk profile.
Rate Limiting Policies
Global Policy
Available in: Admin, Web The GlobalPolicy applies a sliding-window rate limit across all endpoints. It continuously evaluates requests over overlapping time windows to smooth out traffic spikes. This ensures uniform rate enforcement and predictable system load management.
How it works:
Time is divided into fixed windows (e.g., 10 seconds).
The system calculates a weighted combination of the previous and current window’s request counts.
Excess requests are either queued (if allowed) or blocked.
This prevents sudden burst traffic from overwhelming the server.
IP Concurrency Policy
Available in: Admin, Web The IPConcurrencyPolicy limits the number of concurrent (simultaneous) requests that a single IP address can make. Unlike GlobalPolicy, this does not measure the rate; it only measures how many active requests are in progress at once.
How it works:
Each IP is allowed a maximum number of concurrent executions.
If the limit is reached, additional requests are blocked or queued.
This protects the server from connection flooding or resource exhaustion.
Sensitive Endpoint Policy
Available in: Web only The SensitiveEndpointPolicy is a fixed-window rate limit applied only to specific high-risk endpoints. These are endpoints that are more likely to be exploited through automated tools (e.g., registration, password reset, invitation resend).
How it works:
Each IP is allowed a limited number of requests (e.g., 1 request per minute).
Any extra request during the same window is rejected.
Protects actions such as:
/v4/account//v4/reset-password/v4/account/password/reset/v4/enterprise/invitations/...
Helps prevent account creation abuse, password reset misuse, and brute-force attempts.
This policy is not included in the Admin configuration because Admin endpoints are not publicly exposed, and access is already tightly controlled.
Suppression Settings
Available in: Admin, Web SuppressionSettings define how rate-limit violations are batched before being recorded in the database. Instead of writing each violation instantly, the system collects them and flushes them based on time or count thresholds.
How it works:
A batching window (e.g., 30 seconds) determines when to write accumulated alerts.
If the system becomes idle, it flushes early.
If the count exceeds a threshold, it flushes immediately.
This preserves performance by reducing database workload during high-traffic periods.
Summary of Policy Availability
GlobalPolicy
✔
✔
IPConcurrencyPolicy
✔
✔
SensitiveEndpointPolicy
✔
✖ (Not required)
SuppressionSettings
✔
✔
The 'DailyThread' removes all the alerts that have been viewed.
Last updated