Analytics Traffic: Redesign traffic analytics with SOC visualizations, threat context and improved charts #9
Assignees
tech (Luis Melo)
Clear assignees
tech (Luis Melo)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: Weboria/argus-installer#9
Reference in New Issue
Block a user
Problem
The current /analytics/traffic page contains useful information but the presentation is too basic and data-heavy.
Current issues:
The page should be redesigned as a professional traffic analytics dashboard.
Goal
Transform:
Redesign the
/analytics/trafficpage into a professional SOC-grade traffic intelligence dashboard.The current page contains useful information but the presentation is too basic, with many tables and simple bars. ARGUS Enterprise should provide an operational security view where an analyst can immediately understand traffic behavior, threats, attacks, origins and performance impact.
The redesign must follow the same ARGUS SOC dashboard experience used across:
Use the same:
Avoid:
Prefer:
1. Traffic Overview Cards
Replace the current basic cards:
Total Requests
Bandwidth Out
Avg Response
Error Rate
with richer SOC cards.
Example:
Traffic Overview
231K
Total Requests
↑ 12%
Compared with previous period
39.8 MB
Bandwidth Out
128ms
Average Response
4.2%
Error Rate
12
Threat Countries
HIGH
Traffic Threat Level
Each card should include:
2. Traffic Activity Timeline
Replace the simple:
Requests / hour
with an interactive multi-series chart.
Show:
Example:
Traffic Activity
Allowed ─────
Blocked ─────
Challenge ─────
Errors ─────
Time:
1h / 24h / 7d / 30d
Requirements:
3. Bandwidth Analytics
Improve:
Bandwidth out (MB/hour)
Add:
Example:
Bandwidth Usage
Total:
39.8 MB
Top Host:
api.example.com
18 MB
4. HTTP Status Code Analytics
Current:
Status code breakdown
2xx
3xx
4xx
5xx
Replace with visual analytics.
Use donut chart.
Example:
HTTP Responses
🟢 200 OK
82%
🟡 3xx Redirect
10%
🟠 4xx Client Error
6%
🔴 5xx Server Error
2%
Requirements:
5. Response Time Analytics
Current:
Avg
p95
Improve:
Show:
Performance
Average
128ms
P95
420ms
P99
850ms
Add:
6. Security Events Analytics
Current:
Bot blocked
Rate limited
WAF blocked
Replace with SOC visualization.
Show:
Security Actions
🛡 WAF Blocks
2,430
🤖 Bot Defense
850
🚦 Rate Limits
320
🧠 ANIS Intelligence
540
Add:
Timeline chart:
Security Events Over Time
WAF
Bots
Rate Limit
ANIS
7. Geographic Traffic Intelligence
Add GeoIP intelligence.
Every country display must include:
Example:
Top Source Countries
🇨🇳 China
Requests:
12,400
Blocked:
94%
Threat:
🔴 HIGH
🇺🇸 United States
Requests:
8,200
Blocked:
2%
Threat:
🟢 LOW
Use ISO 3166 country codes.
Do not parse country names.
8. Threat Level System
Add threat classification everywhere.
Use:
🔴 Critical
🟠 High
🟡 Medium
🟢 Low
Apply to:
Example:
Source IP
185.xxx.xxx.xxx
🇷🇺 Russia
Threat:
HIGH
Reason:
Known scanner
9. Traffic Categories
Replace:
other
browser
with visual analytics.
Use donut chart:
Traffic Category
Browser
65%
API
20%
Bot
10%
Other
5%
10. HTTP Methods
Replace simple table:
GET 215
with chart:
HTTP Methods
GET
POST
PUT
DELETE
PATCH
Show:
Example:
POST
25,430 requests
Threat relevance:
Medium
11. Protocol Analytics
Improve:
HTTP/1.1
Show:
Protocols
HTTP/3
HTTP/2
HTTP/1.1
TLS Versions
TLS 1.3
TLS 1.2
Include:
12. ASN Intelligence
Redesign:
Top ASNs
into:
Top Source Networks
ASN
Organization
Country
Requests
Threat Score
Example:
AS12345
Cloud Provider
🇺🇸 US
12,500 requests
Threat:
Medium
13. Browser / Operating System / Device Intelligence
Do not show empty sections like:
Browser breakdown will appear here once requests are logged.
Instead:
If no data:
No client fingerprint data available.
HTTPS traffic analysis will populate this section automatically.
When available:
Use:
For:
14. TLS Intelligence
Add:
TLS Security
TLS 1.3
85%
TLS 1.2
15%
Weak protocols:
0
15. Per-host Traffic Leaderboard
Replace the current table:
Domain
Requests
Bandwidth
Avg RT
WAF
Bots
Error %
with SOC cards.
Example:
Top Applications
🌐 api.example.com
Requests:
120K
Bandwidth:
18 MB
Threat:
LOW
WAF:
120 blocked
🌐 login.example.com
Requests:
40K
Threat:
HIGH
WAF:
8,500 blocked
16. Drill-down capability
Every major component should allow navigation.
Examples:
Country:
Click China
→ GeoIP details
→ related IPs
→ related attacks
Status:
Click 403
→ filtered logs
Host:
Click domain
→ host analytics
17. Export
Keep CSV export but improve:
Allow:
Backend/API Review
Review analytics APIs.
Avoid sending raw logs unnecessarily.
Create aggregated endpoints if needed.
Required data:
traffic statistics
requests timeline
bandwidth
status codes
latency
security actions
GeoIP
ASN
browser fingerprint
OS fingerprint
device information
TLS information
host statistics
ANIS intelligence impact
Possible endpoints:
GET /api/v1/analytics/traffic
GET /api/v1/analytics/status-codes
GET /api/v1/analytics/security-events
GET /api/v1/analytics/geo
GET /api/v1/analytics/performance
GET /api/v1/analytics/client-intelligence
Final Goal
The
/analytics/trafficpage must become a premium enterprise SOC traffic intelligence dashboard.A security operator should immediately answer:
The final result should look like a modern security operations platform, not a simple traffic statistics page.
Labels:
component:analytics
component:traffic
component:soc-dashboard
type:enhancement
priority:high
Moved to the correct repository: weboria/argus-appliance#10. argus-installer only tracks customer installer/deployment issues; this is a product feature, so tracking continues there (a private repo). Closing here.