Threat Monitor

The Threat Monitor (MuRu Guard → Settings → Threat Monitor) turns what the Shield plugin records into charts you can read at a glance. It uses only your own log and scan history, so nothing leaves the site except one daily request for Joomla's security announcements.

What you see

• Threat level from Low to Critical. Critical is a confirmed compromise, such as a tripped honeypot. High is ten or more high-severity events, Medium is at least one high-severity event or a steady run of medium ones, otherwise Low.
• Attacks over time by severity, top attack rules and attack types.
• Counts for attacks detected, blocked, failed logins, high and critical events, open High findings and the security score.
• Joomla security news: the latest announcements from Joomla's Security Centre, refreshed once a day.

Free and Pro

Free shows the 24 hour and 7 day views and the last five scans. Pro adds the 30 and 90 day views, top source IPs and countries, failed logins by hour of day, targeted paths, and your score, open findings and file changes per scan.

Recent events

The list under the charts replaces the old Protection Log screen. Free shows the latest 50 events; Pro can filter by level, result, rule and IP, page through every match (the page size is Settings → General → Items per page), export the filtered rows as CSV, and block or safelist an IP from any row. Clear Log empties the live list; older entries stay in the archive.

Open the Threat Monitor after changing a firewall rule: the events it blocks appear here with their rule names, so you can see the effect within minutes.