> For the complete documentation index, see [llms.txt](https://securitybot.gitbook.io/securitybot-knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://securitybot.gitbook.io/securitybot-knowledge-hub/bot-guide/insights.md). # Insights {% hint style="warning" %} **PRO only** — Insights requires a [PRO subscription](/securitybot-knowledge-hub/plans-and-pricing/plans-and-pricing.md). {% endhint %} Your moderation logs show every action SecurityBot takes, one event at a time. Insights sits on top of that history and turns it into a picture of the threats targeting your server, so you can see patterns instead of scrolling through individual events. Insights is **read-only**. It analyzes the activity SecurityBot has already recorded, so there's nothing to enable or configure. Open the page and it's there. *** ### Top Blocked Domains The first thing Insights shows is the domains your server blocks most often, ranked by frequency. Each bar is a domain that SecurityBot's filters have stopped, and its length is how many times it was blocked over the time window you choose. This pulls from both your [Link Filter](/securitybot-knowledge-hub/bot-guide/chat-filters/link-filter.md) and Image Analysis, so domains caught in text and domains caught inside images appear together. A domain climbing the list is a sign of an active campaign worth a closer look, or worth confirming it stays off your allowlist. *** ### Threat Trend The trend chart shows how many domains SecurityBot blocked each day across the selected window, so you can tell at a glance whether attacks on your server are rising, steady, or quieting down. A sudden spike usually means a fresh campaign has started. Like the rest of Insights, the trend counts blocks from your Link Filter and Image Analysis. *** ### New This Window This tile lists domains that SecurityBot has seen for the **first time** within the selected window, newest first. Domains your server has encountered before are left out, so this is a focused view of what's *new* rather than what's most frequent. New domains are the early signal of an emerging scam. A name that mimics a real project (for example, a lookalike of your token or mint site) showing up here is worth reviewing right away. *** ### Most Filtered Members This tile lists the members whose messages most often tripped your link or image filters within the window, busiest first. It's the "who" to complement the domain tiles' "what", so a single member repeatedly posting blocked links stands out. These are filter matches, not moderation verdicts: the count can include false positives (a regular member who happened to share a flagged link). Treat it as a starting point for a closer look, not a judgement. Selecting a member opens their Discord profile. *** ### Activity Pattern This tile shows *when* your server gets hit, as a heatmap of weekday against hour of day: darker cells are busier. It counts link and image filter blocks, and a one-line summary calls out the single busiest window. Times are shown in your own local timezone, so "Tuesday 9pm" means 9pm where you are. Patterns here help you anticipate attacks. If blocks spike every weekend evening, that's when to have moderators on hand, and it's a useful signal when tuning verification or slow-mode for your busiest windows. *** ### Domain Dossier Any domain in **Top Blocked Domains** or **New This Window** is a link. Select one to open its **dossier**, a focused page about that single domain: * **First seen** and **total blocks** across the domain's entire history, not just the current window, so you can tell a one-off from a long-running threat at a glance. * **Channels targeted** shows where the domain was blocked and how often, so you can see whether an attack is concentrated in one channel or spread across your server. * **Activity pattern** shows that one domain's busiest days and hours, so you can tell a steady drip from a timed campaign. * **Recent activity** lists the latest times SecurityBot blocked the domain, combining [Link Filter](/securitybot-knowledge-hub/bot-guide/chat-filters/link-filter.md) and Image Analysis hits. *** ### Drill-Down to Logs From a dossier, **Open in log viewer** jumps straight to your moderation logs pre-filtered to that domain, so you can read the full, raw history event by event without setting up filters by hand. It's the bridge from the big-picture trend back down to exactly what happened, when, and in which channel. *** ### Viewing Insights 1. Open your [server dashboard](https://securitybot.org/dashboard) and select your server. 2. Go to **Monitor → Insights**. 3. Use the time-window selector to view the **last 7, 30, or 90 days**. {% hint style="info" %} Insights only reflects activity SecurityBot has logged for your server. A brand-new server, or one where filters haven't blocked anything yet, will show an empty chart until the first domain is blocked. {% endhint %} *** ### Requirements * **PRO** subscription *** ### What Happens on Downgrade If your server is downgraded from PRO, the Insights page is hidden. Your activity history is preserved, so re-subscribing to PRO restores the page with your data intact. *** Next up: Learn how to manage who can access these tools in [Administering SecurityBot](/securitybot-knowledge-hub/bot-guide/administering-securitybot.md).