Webshield Observability

The Webshield is deeply integrated with ClickHouse. Each block incident is also registered in a special table in the database: blocked_users.

The table schema is as follows:

CREATE TABLE blocked_users (
    address IPv6,
    tft UInt64,
    tfh UInt64,
    reason UInt64,
    timestamp DateTime(3, 'UTC'),
    PRIMARY KEY (timestamp)
)

One important thing to understand: the client can configure different detectors, for example tft_rps and tfh_time. These types of detectors aggregate access logs by TFt or TFh respectively, and as a result, the address field should be empty because many IP addresses might fall under the same TFt or TFh. Similarly, if bad traffic is detected using IP_RPS, the tft and tfh fields should be empty. In other words, this table actually records the characteristic of the user (or group of users) that caused the block.

Field meanings:

Block reason codes: