When was this measured?
Show collection timestamp, lag, and whether the source is still connected.
A monitoring workspace should communicate exactly which server is reporting, when data was collected, and whether the connection is healthy.
Fresh signal sources appear with a timestamp and sampling context. Ordinary activity is not automatically classified as an attack.
No IP addresses, traffic counters or threat events on this page are sourced from your server.
Show collection timestamp, lag, and whether the source is still connected.
Compare against the correct service, duration and workload instead of one global number.
Keep source-level evidence auditable, subject to privacy and retention constraints.
Distinguish a detected condition, a requested firewall change and a confirmed outcome.