How to read Monarx security event details

Content

This guide covers the Monarx security services: Monarx Website Protection and Monarx Website Threat Shield for hosting accounts, and Monarx Server Protection, Monarx Server ThreatShield, and Monarx Server SmartWAF for eligible VPS and server services. Available features and reports depend on your service, subscription, and completed setup.

Open an event from the security report’s log to see more information. Fields differ between Active Protection, ThreatShield, and Firewall Activity.

Field	What it helps explain
Date/time	When the activity was recorded
Action or remediation status	What the event reports happened
URL / request path	The requested web address or path
Rule type	The security check associated with the event
Client IP	The source address recorded for the request
Country/location	Location information associated with the recorded IP
User agent	Software identification sent with a web request
File path / owner	The file or hosting account associated with the event, where available
Network fields	Network-specific information in firewall events

A location or user-agent label is context, not reliable proof of who a person is. A file path identifies a file associated with the record; it does not explain the whole security condition by itself.

Check the action first. A ThreatShield Logged event is different from a Blocked event. An Active Protection discovery is different from a confirmed cleaning action.

Asking Support about an event

Provide your service reference, feature, selected period, event time, and a screenshot or event reference if shown. Explain what you expected and what concerns you.

Avoid posting full file paths, account names, IP addresses, or screenshots publicly. Never include passwords or API secrets.