The Network section of the Monarx Web App is where you visualize data from SmartWAF, our firewall service. It shows the IP addresses that have been blocked, giving hosting teams a way to audit and investigate firewall activity across their fleet.
Understanding the Data
Each record in the Network section represents an IP address that SmartWAF blocked. To help hosting teams find and investigate specific activity, the data can be filtered by date, host ID, IP, and firewall list.
Filtering
Discovered: A time-based filter to view blocked IPs within a specific window — useful for correlating firewall activity with an attack, an incident report, or a customer complaint from a particular time period.
Host ID: The unique identifier for the specific server registered in the Monarx platform. Filter by Host ID to see only the blocks that occurred on a particular server, useful when investigating an issue reported on one specific box in your fleet.
Related IP: The IP address that was blocked. Filter by IP to confirm whether — and how often — a specific address has been blocked, which is useful when a customer asks "is this IP being blocked, and why?"
Firewall List: The specific list/rule source responsible for the block (for example, a custom IP Rule Override versus one of Monarx's own reputation-based blocklists). Filter by Firewall List to understand which rule set is driving the block, which is especially useful when confirming whether a manually created rule is working as expected.
These filters can be combined to narrow down to the exact activity you're looking for — for example, filtering by a specific Host ID and Discovered range together to review all blocks on one server during a suspected attack window.
💡 Useful Tip: If you have a specific use case or questions on how to use these filters to drill down to the exact information you're looking for, do not hesitate to contact our Support team.
📚 Related Articles