Forensic PDF error IP report (7 days)

Reading Time: < 1 minute

When to use

The script is needed when the error rate increases in Web Stats or repeated 4xx/5xx appear, and the team needs to quickly gather an evidence picture for incident resolution.

Prerequisites

  • The online and Web Stats server transmits up-to-date data.
  • The user role allows working with web metrics and incidents.
  • For the feature, the active plan where the forensic PDF report is available.

Steps

  1. Open the desired server and go to Web Stats.
  2. Make sure RPS/error rate dynamics are updated in real time.
  3. Start formation Forensic PDF report in 7 days.
  4. Wait for the collection to complete: the UI displays the preparation progress.
  5. Download PDF and attach to incident or forward to SOC/SRE.

How to read the result

  • Select the IP with the largest share of error events.
  • Check for waveform repeatability in the time window.
  • Compare findings with perimeter changes, alerts, and audit events.

What to check after the action

  • After the protective changes, the error rate returns to the working baseline level.
  • The decision and the actual result are recorded in the timeline of the incident.
  • The team has a single PDF artifact to transfer between shifts.

Related pages

Scroll to Top