Insights
See the domains attacking your server, ranked by how often they're blocked. Available on PRO.
PRO only — Insights requires a PRO subscription.
Your moderation logs show every action SecurityBot takes, one event at a time. Insights sits on top of that history and turns it into a picture of the threats targeting your server, so you can see patterns instead of scrolling through individual events.
Insights is read-only. It analyzes the activity SecurityBot has already recorded, so there's nothing to enable or configure. Open the page and it's there.
Top Blocked Domains
The first thing Insights shows is the domains your server blocks most often, ranked by frequency. Each bar is a domain that SecurityBot's filters have stopped, and its length is how many times it was blocked over the time window you choose.
This pulls from both your Link Filter and Image Analysis, so domains caught in text and domains caught inside images appear together. A domain climbing the list is a sign of an active campaign worth a closer look, or worth confirming it stays off your allowlist.
Threat Trend
The trend chart shows how many domains SecurityBot blocked each day across the selected window, so you can tell at a glance whether attacks on your server are rising, steady, or quieting down. A sudden spike usually means a fresh campaign has started.
Like the rest of Insights, the trend counts blocks from your Link Filter and Image Analysis.
New This Window
This tile lists domains that SecurityBot has seen for the first time within the selected window, newest first. Domains your server has encountered before are left out, so this is a focused view of what's new rather than what's most frequent.
New domains are the early signal of an emerging scam. A name that mimics a real project (for example, a lookalike of your token or mint site) showing up here is worth reviewing right away.
Most Filtered Members
This tile lists the members whose messages most often tripped your link or image filters within the window, busiest first. It's the "who" to complement the domain tiles' "what", so a single member repeatedly posting blocked links stands out.
These are filter matches, not moderation verdicts: the count can include false positives (a regular member who happened to share a flagged link). Treat it as a starting point for a closer look, not a judgement. Selecting a member opens their Discord profile.
Activity Pattern
This tile shows when your server gets hit, as a heatmap of weekday against hour of day: darker cells are busier. It counts link and image filter blocks, and a one-line summary calls out the single busiest window. Times are shown in your own local timezone, so "Tuesday 9pm" means 9pm where you are.
Patterns here help you anticipate attacks. If blocks spike every weekend evening, that's when to have moderators on hand, and it's a useful signal when tuning verification or slow-mode for your busiest windows.
Domain Dossier
Any domain in Top Blocked Domains or New This Window is a link. Select one to open its dossier, a focused page about that single domain:
First seen and total blocks across the domain's entire history, not just the current window, so you can tell a one-off from a long-running threat at a glance.
Channels targeted shows where the domain was blocked and how often, so you can see whether an attack is concentrated in one channel or spread across your server.
Activity pattern shows that one domain's busiest days and hours, so you can tell a steady drip from a timed campaign.
Recent activity lists the latest times SecurityBot blocked the domain, combining Link Filter and Image Analysis hits.
Drill-Down to Logs
From a dossier, Open in log viewer jumps straight to your moderation logs pre-filtered to that domain, so you can read the full, raw history event by event without setting up filters by hand. It's the bridge from the big-picture trend back down to exactly what happened, when, and in which channel.
Viewing Insights
Open your server dashboard and select your server.
Go to Monitor → Insights.
Use the time-window selector to view the last 7, 30, or 90 days.
Insights only reflects activity SecurityBot has logged for your server. A brand-new server, or one where filters haven't blocked anything yet, will show an empty chart until the first domain is blocked.
Requirements
PRO subscription
What Happens on Downgrade
If your server is downgraded from PRO, the Insights page is hidden. Your activity history is preserved, so re-subscribing to PRO restores the page with your data intact.
Next up: Learn how to manage who can access these tools in Administering SecurityBot.
Last updated