Suspicious Activity Report

Suspicious activity on your website refers to abnormal access patterns by visitors to your website. For instance, if your site suddenly receives an unusual number of requests from a single user (IP address) or much higher than normal traffic during a set time period, it should be investigated. Being alerted to such activities is important as it allows you to act quickly to correct any security threat and minimise damage. 

A suspicious activity report can be set up and automatically emailed to specific recipients to enhance monitoring.  How often the report (CSV file) is sent can be configured. The report will contain the following information:

• unexpected number of requests per time period for a user is over a session,
• unexpected number of total requests for a set time period,
• and other custom data that can be queried.

Example of standard report

Configure Suspicious Activity Report

NOTE - This feature is a custom implementation, so there may be other settings available for your site.  

To configure the report settings:

1.  Navigate to Settings → Feature Management → System.
   
   
2. Toggle ON Suspicious Activity, then click Configure. 
   
   
3. In the Suspicious Activity Settings screen, to enable the feature for your site, toggle ON Enable Periodic Report Email. 
   
   
4. To set task date/time and frequency, enter Scheduled Task Settings.
   Schedule Start Date: select the date and time the system will run the suspicious activity task.
   Report every N Minutes: enter the frequency (in minutes) the report generates.
   
   
5. Report Data Query Parameters helps to monitor unusually high traffic activity on your site.
   Time Period Minutes: enter the period for monitoring. Default: 60min 
   Pages Per Time Period: enter the number of pages accessed per the time period entered to be included
   Pages Per Session: enter the number of pages accessed per session to be included
   
   
6. Report Email Settings sets information about the report recipient(s) and email message. 
   Send to Email Address: enter the email address the report is to be sent to
   Email Subject: enter subject title for email. Default: Suspicious activity report
   Email Content: edit the message body in the editor as required.  Default: Attached is the suspicious activity report data.

Related help

• Page:
  User Impersonation
• Page:
  Update Session Timeouts
• Page:
  User Password Rules
• Page:
  Lock a Website User to an IP Address
• Page:
  Monitoring and Restriction Requests from IP Addresses