Reference
Reference
What every page and setting in Heimnull does, how detection and mitigation work, and the details of running it.
The console
Section titled “The console”The left rail groups the pages into Traffic (Live, Explore, Interfaces, Planning, Unidentified), Security (Attacks, Mitigations) and System, with Configure at the bottom. Press Ctrl+K (Cmd+K on a Mac) anywhere to find an address, prefix, AS, application, interface, exporter, hostgroup, country or page.
- Live: the last five minutes, second by second.
- Explore: one filter and time range over all stored traffic, and the filter syntax.
- Host, AS and other entity pages.
- Interfaces, Planning and Unidentified.
- Attacks and Mitigations.
- System: health, ingest, BGP, datasets, storage and updates.
Configure
Section titled “Configure”Exporters · Interface settings · Networks · Hostgroups · Whitelist · Notifications · Classification · BGP · Users and API tokens · Settings · Audit log and export
How it works
Section titled “How it works”- Detection: metrics, limits, baselines, attack types and how fast it reacts.
- Mitigation: blackholes, FlowSpec, the lifecycle of a mitigation, escalation and the safety checks.
- Enrichment: direction, ASNs, geolocation, applications, NAT and SNMP.
- License states.
Operations
Section titled “Operations”- Environment variables in
.env. - Ports.
- API and metrics: tokens, the OpenAPI description, Prometheus.
- Storage and retention.
- Release notes.