Skip to content

Threat Scoring Quick Reference

import { LinkCard } from ‘@astrojs/starlight/components’;

This page provides a quick reference for threat scores. For a comprehensive deep-dive into how scoring works, see the Core Concepts guide.


ScoreLevelAction
0-20MINIMALAllow
21-40LOWLog
41-60MEDIUMChallenge
61-80HIGHBlock
81-100CRITICALBlock + Alert
CategoryWeightReliability
Honeypot Signals40%Highest
Attack Signatures25%High
Browser Fingerprint12%Medium
Behavioral Analysis10%Medium
TLS Fingerprint7%Medium
IP Reputation3%Low
HTTP Headers2%Low
User Agent1%Low
CategoryMeaning
AttackerActive exploitation attempt
BotAutomated with fingerprint anomalies
ScannerTriggered honeypot/decoy
CrawlerKnown crawler User-Agent
ScraperFingerprint anomalies only
LegitimateNormal human visitor

The Threat Score column shows the unified score (0-100). The Category column shows the threat classification.

Click on any detection to see:

  • Full score breakdown by category
  • Contributing signals
  • Confidence percentage
  • Raw detection data

Click the ? icon next to any threat score to open the explanation dialog, which shows how the score was calculated.


Use the filters panel to narrow detections:

  1. By Score Range: Set min/max thresholds
  2. By Category: Select specific threat types
  3. By Level: Filter to HIGH/CRITICAL only

Q: Why is my score different from the sum of signals?

A: Scores are weighted averages, not sums. A honeypot score of 30 contributes 30 × 40% = 12 points, not 30 points.

Q: What does “Unknown” category mean?

A: This was a legacy category. All detections are now classified as one of: Attacker, Bot, Scanner, Crawler, Scraper, or Legitimate.

Q: Why is confidence low?

A: Confidence reflects how many signal categories contributed. With only 1-2 categories active, confidence is lower. More signals = higher confidence.


For complete documentation on scoring methodology, category weights, and classification logic, see the Threat Scoring Core Concepts guide.