One incident per attack, not fifty log lines
During a raid every detector fires at once. AntiLink pulls those signals together into a single incident with a severity, a timeline, an owner and notes, so your team works one problem instead of scrolling a wall of alerts.
Free on every plan.
What your detectors saw
Member Defense
Join spike: 14 accounts in 10 seconds
Link protection
Phishing link removed (nitro-gift.example)
Honeypot
Trap channel triggered by a new account
Scam detection
Fake giveaway message flagged
Emergency Lockdown
Lockdown switched on
Raid
5 events from 4 detectors
First seen
02:14 UTC
Assigned to
@timeout
Notes
Lockdown on, quarantined the new accounts, invites paused.
How AntiLink decides what is an incident
One window, one incident
A detection that arrives within 30 minutes of an open incident joins it instead of starting a new one. A sustained attack stays one story.
Medium signals need a burst
A single medium signal, such as one high-risk link, opens nothing. Three within ten minutes do. High and critical signals open an incident straight away.
Routine blocks stay out
A blanket external-link policy and the spam filters fire all day. They never open an incident, so the board only shows attacks.
Severity only rises
Each new signal can raise the incident severity, never lower it. A raid that turns into a nuke attempt reads as critical.
Work it to the end
Move an incident through its status, assign it to yourself so the team knows who has it, and leave notes for the next responder. Mark a mistaken one as a false positive.
- Open
- Acknowledged
- Investigating
- Contained
- Resolved
- False positive
Ids and summaries, never content
An incident keeps user and channel ids, the detection type, the severity and a short summary. Message content and full links are never stored. Each incident keeps up to 500 timeline entries and keeps counting after that.
See the attack, not the noise
Add AntiLink and the Incidents tab fills itself the first time something goes wrong.