Protected traffic
Operations center
DDoS Defense
Apps
● BringmeOnline protection platform · tenant-scoped management · network execution remains disabled
Company setup
Initialize DDoS Defense for this company
This Console company has no DDoS client yet. An authenticated platform administrator can create its isolated scope here. No existing users, devices, networks or WAF policies will be moved, and network execution stays disabled.
BBringmeOnlineDDoS Defense
Secure management access
Sign in to your account
Enter a short-lived OIDC access token. It remains only in this page's memory and is forgotten on reload.
Uses Authorization Code with PKCE. No browser client secret is required or accepted.
BBringmeOnlineDDoS Defense
Secure authentication
Signing you in…
Verifying your identity and preparing your secure client workspace.
Live posture
Overview
● ADAPTIVE NETWORK DEFENSE
Every protected network, one secure view
Detect, investigate, report, and safely coordinate DDoS response across ISP and customer environments.
Alert-onlyControlled response posture
Appliance fleet
Current device health
| Device | Overall | Connectivity | Telemetry | Resource / service issues | Evaluated |
|---|
Telemetry coverage
Source readiness
| Source | Posture | Latest aggregate | Latest health report | Collector coverage |
|---|
Certificate lifecycle
Appliance renewal readiness
Expiry status and centrally recorded lifecycle alerts. This view cannot issue, renew, revoke, or install a certificate.
| Device | Posture | Expires | Time remaining | Central alert | Next action |
|---|
Exposure
Top targeted addresses
Network headroom
Capacity posture
Incident distribution
Attack states
Recent activity
Latest incidents
Flow intelligence
Traffic analytics
Network boundary
Traffic by protocol
Collector health
Telemetry readiness
| Destination | Average BPS | Peak BPS | Average PPS | Samples |
|---|
Detection
Attack incidents
| State | Device | Victim | Classification | Current | Peak | Started |
|---|
Application protection integration
WAF security events
Tenant-scoped detections received from separately deployed WAF nodes. These events do not alter DDoS mitigation or network traffic.
| Severity | Time | Source | Event | Action | Host / path | Rule | Message |
|---|
Aggregate L7 detection
HTTP/API flood alerts
Authenticated aggregate request-rate evidence that reaches a versioned review threshold. No WAF policy, challenge, rate limit, block, provider call, or traffic change is performed.
| Observed | Customer | Protected prefix | Policy | Classification | Observed RPS | Review threshold |
|---|
Protocol defense telemetry
TCP and DNS evidence
Authenticated aggregate SYN, connection-pressure, DNS query, and random-subdomain evidence. DNS names, client identities, payloads, and session contents are never retained.
| Observed | Protected prefix | Sensor | SYN PPS | Connection pressure | DNS QPS | Random-subdomain estimate |
|---|
Safe application telemetry aggregates
Derive bounded category and count summaries from retained WAF events. The result excludes raw hosts, paths, queries, headers, cookies, tokens, bodies, addresses, rule text, tags, and metadata. Event rate is not total request coverage.
Controlled response
Mitigation review
Create and approve bounded response plans. Approval records a lease and audit evidence but cannot change the network.
| State | Attack | Action | Target | Lease | Requested by | Actions |
|---|
Scrubbing evidence
Certificate-bound capacity and latency reports used by review-only placement admission. These records cannot enable execution.
| POP | Agent | Observed | Certificate | Payload digest |
|---|
| POP | Target | Forward RTT | Clean-return RTT | Observed |
|---|
Isolated lab interface
Live clean-return counters
Validated carrier and packet counters sampled from the configured Linux clean-return interface. This view sends no probe and cannot enable forwarding, attach XDP, change routing, or authorize mitigation.
| Health | POP / tunnel | Interface | Transmit | Receive | Observed / activity | Evidence digest |
|---|
Single-VM simulator
Retained clean-return evidence
Operator imports and enrolled-agent reports retain checksum consistency for the loopback simulator only. They do not measure a tunnel or live packet path and cannot affect mitigation.
| Outcome | Tunnel | Observed | RTT / loss | Evidence digest | Source | Recorded by |
|---|
Isolated lab evidence
Scrubbing diversion lifecycle
Latest durable primary, failover, verification, withdrawal, and rollback state. Authorization status is informational and cannot start a diversion.
| State | Authorization | Prefix | Path references | Verified | Updated | Result |
|---|
Propose response plan
WAF execution review
Create and approve time-bounded review intents only after package-signature and rollback-readiness gates pass. This workflow is immutable and audited; provider execution remains unavailable.
Review lifecycle timeline
Correlates review-only plan, placement, evidence, lifecycle, envelope, and attestation records. Signed payloads are never shown.
Adapter readiness evidence
Record contract-matched review evidence manually. This never probes hardware, configures credentials, or contacts an adapter.
Signed readiness evidence
Verifies detached Ed25519 evidence against a configured public trust anchor. No signer or adapter is contacted.
Review trust anchors
Public Ed25519 keys used only to verify review evidence. Private keys are never stored or requested.
| Key | Reviewer | State | Expires | Version |
|---|
Incident-case link
Create one immutable review-only link to an existing incident case.
Overdue review queue
Informational internal escalation only. It cannot send a notification or execute a mitigation.
| Mitigation | Owner | Due | State | Overdue by |
|---|
Review task ownership
Assign the review package to an operator with a due date. The overdue state is informational and cannot trigger mitigation.
| Mitigation | Owner | Due | State | Escalation |
|---|
Close a review lifecycle
Withdrawal and failure are review-only terminal records. They require a reason and cannot alter network traffic.
Issue review envelope
Creates a short-lived signed review artifact for manual transfer only. It does not contact a controller or change the network.
Review controllers
Only explicitly authorized enrolled controllers can receive or attest review envelopes.
| Controller | State | Operations | Certificate expiry |
|---|
Adapter readiness contracts
Static evidence requirements for future adapter review. No credential, health probe, or network connection is configured.
| Adapter | Configuration evidence | Health evidence | Read-back evidence | Withdrawal evidence |
|---|
Amplification packet-evidence reference
Record only an opaque capture reference, SHA-256 digest, bounded verification counts, and redaction level. Packet payloads, addresses, capture files, URLs, and retrieval paths are never stored here.
Amplification investigation
Create and review a structured evidence package. Assessment records an operator conclusion only; it never changes the detector's classification, attack state, or mitigation authority.
Amplification evidence integrity
Optionally sign the server-generated metadata-only payload with an existing Ed25519 review trust anchor. Signatures, reviewer identity, retention expiry, and freshness warnings are review evidence only; no private key or packet content is entered here.
Detection controls
Policies & rules
| Name | Mode | Baseline | Fixed BPS | Fixed PPS | Trigger | Recovery | Actions |
|---|
Create detection policy
Detection-quality budgets
Immutable review targets compare retained triage and fingerprint evidence. They cannot tune detector thresholds, authorize mitigation, or change network traffic.
| Version | Label | Window | Minimum triage | Maximum false positives | Minimum fingerprint coverage | Recorded | Approval |
|---|
Coverage
Protected assets
| Prefix | Name | ISP | Customer | Status | Policy | Actions |
|---|
Add protected prefix
Protected appliances
Client devices
| Device | Client / ISP | Connectivity | Version | Management IP | Platform | Current traffic | Attacks (24h) | Certificate expiry | Last seen | Actions |
|---|
Device telemetry
Observed traffic
Assignment
Protection scope
Appliance health
Current signals
Health evidence
Degradation and recovery timeline
| Time | Signal | Transition | Severity | Evidence |
|---|
Device-specific incidents
Attack history
| State | Victim | Classification | Peak | Started |
|---|
Select a device to inspect its health, traffic, protection scope, and attacks.
Protected appliances
Client devices
Lifecycle management
Appliance releases
| Release | Revision | State | Channels | Formats | Requested | Actions |
|---|
Set up release access for this company
Propose channel promotion
Authorize client image formats
Scrubbing fabric
Topology & capacity
| POP | Region | State | Available | Inbound | Attack | Nodes | Observed |
|---|
| POP / link | Kind | Provider | Health | Capacity | Current |
|---|
Administration
ISP & customer configuration
| ISP | ASN | Network model | CGNAT context | Actions |
|---|
Flow collection
Exporter onboarding
Routing inventory
Routers
Safe activation sequence
Bring a customer online
- Create the ISP and tenant scope.
- Add and validate protected prefixes.
- Create an alert-only detection policy.
- Register the exporter source address and restrict UDP at the firewall.
- Configure NetFlow, IPFIX, or sFlow on the customer router.
- Verify templates, sampling, sequence gaps, and baseline learning before enabling alerts.
Add ISP
Add router inventory
Approve pending appliance
Manual recovery enrollment (advanced)
Administrator setup
Router & BringMeOnlineWAF
Enter your own connection settings and run read-only connection checks. FRR can verify its SSH identity. The advanced FRR response option requires signed, qualified lab plans and an installed response worker. BringMeOnlineWAF rule execution requires its verified API contract.
Scrubbing operations
Packet measurements
Protection status
Protection status has not been loaded.
Choose verified XDP pass/drop measurements or read-only Linux receive/transmit totals, including on VMs. Linux totals describe interface traffic and do not establish mitigation effectiveness. A new baseline is established after a restart, interface change, policy change, counter reset, or collection gap. Customer-specific attribution is unavailable.
Measurements have not been loaded.
| Site / interface | Status | Observed | Source | IPv4 pass / drop (packets/s) | IPv6 pass / drop (packets/s) | Receive / transmit (packets/s) | Receive / transmit (bytes/s) |
|---|
Response workflow
Approval, execution, effectiveness, escalation and restoration status is updated automatically from retained incident evidence.
| Attack | Stage | Action needed | Blockers | Updated |
|---|
Administrator packet protection setup
Prepare the existing scrubber VM with its own management, ingress and clean-return interfaces. Enter file locations under /etc/bmo-ddos on that VM; keep private keys and database credentials in those files. Saving prepares a configuration for installation. Activation requires qualified deployment evidence, signed acceptance and a healthy independent watchdog.
Install and commission packet protection
Installation readiness
Upload the scrubber's recent installation report to see missing prerequisites. Reports describe local checks; activation is verified separately.
Save a setup before checking installation.
Administrator routing protection setup
Connect a local GoBGP v3 speaker to your network router for diversion, blackholing or FlowSpec. Enter the API address, router peer and installed file locations. Keep credentials in root-owned files on the routing host. Saving or downloading settings does not change the network. Signed, expiring plans and deployment qualification are required; diversion also requires current packet protection.
A tenant administrator is required to configure routing protection.
Routing activity has not been verified. Hardware forwarding is not established by the routing API.
Advanced TCP and DNS protection setup
Configure routed TCP handshake protection and authoritative DNS forwarding. Enter your own networks, backend settings and installed credential-file locations. Saving settings does not enable protection. Activation requires a signed, short-lived approval and qualification on this deployment. No recursive DNS, encrypted DNS or hardware-capacity claim is implied.
Setup progress
Save a configuration to start.
Install and connect this scrubber
Traffic delivery readiness
Configure packet protection, advanced protocols and routing on the existing scrubber. Backend reachability and BGP advertisements alone do not prove clean customer delivery.
Packet protection settings · Router and diversion settings
Configure external delivery verification in the settings above.
Run the external delivery check
Use the enrolled observer outside the scrubber and the enrolled witness on the scrubber. Transfer the saved setup and downloaded check to each host with root ownership. Start the witness first, then run the external probe during its ten-second observation window. Upload both signed reports below.
A tenant administrator is required to configure protocol protection.
Protocol protection has not been verified.
Administrator collection setup
Service administration
Customer configuration
Complete customer service profile.Record devices, addressing, networks, desired routes, BGP peers, attack coverage, and report delivery. Network and BGP settings are inventory only and are never pushed automatically.
| Customer | Status | Device / WAN | Networks | BGP | Attack coverage | Reports | Actions |
|---|
Create or edit customer configuration
Customer reporting
Generate and download reports
| Customer | Period | Generated | Incidents | Peak traffic | Download |
|---|
Service delivery
Readiness and billing handoff
Review customer onboarding readiness, or download a checksum-bound usage handoff. Both actions are read-only and never calculate charges or change network traffic.
Protected service profile
Record legitimate TCP/UDP ports and optional PPS expectations for review. These values do not change detection, attach a scrubber, or authorize mitigation.
| Service | Customer / prefix | Protocol / ports | Expected PPS | Review ceiling | State | Action |
|---|
Amplification artifact comparison
Compare one named vector's prior unsigned review artifact with the current scoped readiness. This stores nothing and cannot attach or execute a policy.
Protection entitlement
Commercial limits constrain protected prefixes, incident cases, review mitigations, and visible report retention. They cannot enable mitigation.
| Customer | Tier | Prefix limit | Incident limit | Review limit | Retention | State |
|---|
Customer protection summary
A read-only customer status view of service limits, active incidents, review mitigations, and latest report metadata.
Customer service delivery
Read-only onboarding readiness, protected-service catalog, scheduled-report delivery state, communication readiness, and 30-day detection-quality evidence. Activation is separately readiness-gated and remains non-executing.
Customer viewer access
Map an active customer-viewer identity to exactly one customer workspace, or revoke that workspace. Every mapping change is retained as an append-only audit event.
| Viewer | Customer | State | Updated | Action |
|---|
| Time | Viewer | Customer | State | Changed by |
|---|
Customer notification contacts
Contacts begin pending. A tenant administrator records verification before a customer viewer can manage its event preferences. Contact records do not send email by themselves.
| Name | Events | Verification | Action |
|---|
Customer service operations
Service-request transitions record operational ownership only. They never apply requested prefix, report, or onboarding changes.
| Customer | Type | Request | State | Owner | Due | Action |
|---|
| Customer | Delivered | Pending | Dead-lettered | Oldest pending | Latest delivery |
|---|
| Customer | Attacks | Triaged | Benign rate | Feature coverage | Suppressed |
|---|
Detection-quality acknowledgement
Records that a quality finding was reviewed. It never changes thresholds, profiles, alerts, routing, or mitigation.
Service-request detail and SLA queue
These read and organize operational work only. They cannot apply a requested onboarding, prefix, reporting, or network change.
| Customer | Request | Escalation | Response due | Resolution due |
|---|
Internal SLA escalation records
Reconciliation records overdue work for internal follow-up only. Acknowledging or resolving a record neither sends a message nor changes a service request.
| Customer | Request | Type | State | Owner | Detected | Action |
|---|
Detection-quality review evidence
Acknowledgements and comparisons are observational. They do not tune profiles automatically, suppress alerts, route traffic, or enable mitigation.
| Customer | Finding | Window | Acknowledged by | When |
|---|
| Customer | Profile | Before attacks | After attacks | Benign rate | Evidence |
|---|
Operational evidence export
Search all authorized records on the server by customer, state or finding, and UTC dates. Browse pages in identifier order, then export the displayed page.
Internal notification policies
Enabled policies create portal inbox items for overdue SLA requests, detection triage marked needs data, and seven-day rollout reviews. Processing runs every minute. Retention and deadline settings apply to new items; email and webhooks are not used.
My operational inbox
Acknowledging records that you have seen this work. Resolve the underlying service request or detection review separately. Items expire according to the policy in effect when they were created.
| Customer | Work | State | Acknowledge by | Source | Action |
|---|
Optional subscriber context
CGNAT configuration
DDoS detection is independent of CGNAT.Use this area only for customers that need subscriber correlation behind shared public addresses. Direct-address customers remain fully protected without it.
Customer profiles
CGNAT eligibility
Retention
Context safeguards
Audited subscriber-context lookup
Safe network validation
DDoS simulation lab
Isolated synthetic telemetry.The simulator writes bounded flow records using reserved documentation addresses. It sends no traffic and never contacts customer or Internet systems.
Network DDoS
Generate lab scenario
Alert delivery
Notifications
| Endpoint | Incident | Transition | Status | Attempts | Created |
|---|
| Time | Device | Event | Severity | Details |
|---|
Campaign routing
Configured webhook routes
Only preconfigured, tenant-scoped signed webhook endpoints appear here. Enabling a route sends future campaign workflow events; it cannot create an endpoint or change network traffic.
| Endpoint | Campaign events | Version | Updated | Action |
|---|
Campaign acknowledgement policy
Internal queue
Overdue campaign acknowledgements
| Campaign | Severity | Owner | Escalation due | Overdue |
|---|
Client access
Client users
Client users are external identities assigned only to this client. They cannot access BLCR organization administration, other clients, or platform-wide permissions.
| User | Identity provider | Client role | Status | Access |
|---|
Invite a client user
BLCR organization
Organization users
| Name | Provider | Roles | Groups | Status | Action |
|---|
Add or edit a company or client user
Company access
Groups
| Group | Description | Roles | Members | Status | Action |
|---|
Create or edit access group
Authorization model
Permissions
BringmeOnline administration
Clients
Each client is isolated by tenant and partition. Select a client scope from the header to manage its users, devices, policies, and data.
| Client | Tenant status | Partition | Partition status | Current scope | Action |
|---|
Add client
Add client partition
Platform governance
Access and client audit
| Time | Actor | Action | Resource | Details |
|---|
Customer workspace
Protection status
Service requests
Request operational follow-up
| Type | Request | Status | Updated | Details |
|---|
Select a request to view its updates.
Onboarding
Service readiness
Protection catalog
Monitored services
| Service | Prefix | Protocol / ports | State |
|---|
Service events
Recent incidents
Acknowledgement records customer receipt only; they never change incident state or mitigation.
| Incident | Severity | Status | Opened | Resolved | Action |
|---|
Customer-safe incident detail
Incident timeline
Reporting
Available reports
Review displays only customer-safe L7/WAF aggregates and their coverage limits. Download retains the complete eligible JSON snapshot.
| Report ID | Period | Starts | Ends | Created | Actions |
|---|
Report evidence
L7/WAF aggregate evidence
Report comparison
L7/WAF aggregate deltas
Campaign status
Related investigations
This view includes only investigations linked to your incidents. It does not expose source attribution or other customers.
| Case | Severity | Status | Classifications | Last seen |
|---|
Notification contacts
Verified contact preferences
| Name | Events | State | Action |
|---|
Completed incident review
Service follow-up
These completion summaries exclude internal root-cause analysis, lessons, owners, and corrective-action details.
| Incident | Summary | Completed |
|---|
Service status
Approved incident updates
Only separately approved operational updates appear here. Delivery to email or webhooks is not enabled.
| Incident | Title | Update | Approved |
|---|
Protected service
Protected prefixes
| Name | Prefix | State |
|---|
Detection engineering
Detection operations
Profiles are versioned customer tuning records awaiting separately reviewed detector integration. Fingerprints, triage, customer updates, and analytics are operational evidence only; none changes routing, mitigation, or customer delivery.
Customer detection profiles
| Customer | Profile | Version | Baseline | State |
|---|
| Customer | Profile | Version | State | Preview |
|---|
Attack fingerprint and analyst triage
| Attack | State | Fingerprint | Owner | Disposition | Confidence | Action |
|---|
Customer protection policy
Versioned review preferences consolidate an entitled customer's protected prefixes, advisory detection profile, preferred review path, scrubber POP inventory, notification categories, and exclusions. Saving one never changes detection, sends a notification, or changes traffic.
Application protection policy
Define an HTTP/S host, path, method, request-rate, API/bot, and preferred-action review policy. It is immutable review metadata only: no request body, cookie, credential, provider call, challenge, block, or traffic change occurs.
WAF provider capability inventory
Record an opaque provider/site capability declaration for review. This stores no endpoint, URL, credential, secret, request content, provider call, deployment, challenge, block, or traffic change.
Compile application WAF review artifact
Compare one immutable application policy and WAF capability version. The deterministic artifact reports declared compatibility only; it is never stored, signed, sent to a provider, deployed, or executed.
Application WAF review change sets
Bind one immutable policy version, opaque provider/site capability version, and recomputed artifact checksum into an append-only review record. Decisions are evidence only: neither approval nor rejection deploys, calls a provider, or changes traffic.
Application WAF release packages
Create immutable, unsigned review packages only from approved, current review decisions. A package is evidence for later controlled delivery design; it cannot sign, deploy, call a provider, dry-run, read back, challenge, block, or change traffic.
Disabled WAF provider adapter contracts
Record a versioned, opaque adapter contract and metadata-only capability-discovery, dry-run, or read-back evidence. Connection references are identifiers only; do not enter an endpoint, credential, secret, request, provider response, or payload. Nothing here contacts a provider or enables execution.
WAF release signature verification
Retain immutable public Ed25519 trust-anchor versions and verify an externally created detached signature over a server-generated package payload. Private keys are never entered or stored. Verification is review evidence only and never signs, deploys, contacts a provider, or changes traffic.
WAF release rollback governance
Create immutable review-only rollback plans from a verified package signature and record metadata-only withdrawal, read-back, and emergency-stop evidence. These records cannot withdraw, stop, deploy, contact a provider, or change traffic.
Application-signal correlation
Record only retained WAF/application events that overlap an attack window. Group snapshots summarize evidence coverage; neither establishes causation nor changes classification, incident state, notifications, or mitigation.
Customer-safe incident update
Drafting and approval are separate records. Approval exposes the update only in the mapped customer workspace; no email or webhook is sent.
Customer detection analytics
| Customer | Attacks | Peak | Cases | Confirmed | Benign | Fingerprints |
|---|
| Customer | Recommendation | Suppressed |
|---|
Customer incident workflow
Incident operations
Cases, ownership, notes, and SLA evidence are scoped operational records. They cannot enable or execute mitigation.
| State | Severity | Customer | Owner | Response SLA | Resolution SLA | Updated | Actions |
|---|
Open incident case
Case workflow, ownership, and notes
Customer SLA policy
| Customer | Response | Resolution | Version |
|---|
Response and resolution SLO
Versioned response playbook
Templates are immutable. Attach one applicable version to an open case to materialize accountable tasks.
Tasks and shift handoff
Task assignment/completion and ownership handoff append to the case evidence timeline; neither changes mitigation.
Final post-incident review
Available only after the case is resolved or closed. The customer-facing summary is a separate, restricted field.
Corrective actions
Corrective actions require a completed review; their assignment and completion are retained in the same case timeline.
Advisory correlation
Threat intelligence
Signed feeds are staged and activated by separate operators. They create advisory evidence only; they never change detection scores, routing, or mitigation.
| Feed | Version | Provider | Indicators | Expires | State | Actions |
|---|
Stage signed feed
Activate or roll back version
Cross-customer analysis
Shared-source campaigns
Groups two or more tenant-scoped attacks that share a source ASN within the selected lookback window. It is not a finding of attribution and does not change detection.
| Source ASN | Attacks | Customers | Classifications | First seen | Last seen | Actions |
|---|
Operational evidence
Campaign investigations
Capturing a campaign freezes its qualifying shared-source evidence. Its lifecycle history and incident-case links are append-only operational records.
| Source ASN | Evidence | Classifications | State | Severity | Owner | Updated | Actions |
|---|