Most monitoring systems average data, which can hide short-term traffic spikes. We use adaptive sampling to ensure that all significant attacks are visible.
For each sample, the system calculates the value using a hybrid rule:
- If a spike is detected (traffic exceeds the 95th percentile*), the graph shows the maximum traffic value for the selected period, so you can see the peak attack power.
- If traffic is within normal limits, the graph shows the average value — giving you an accurate view of the average load on the domain during that period.
This way, for each sample the system determines which data is most important to display: precise peak values for attack analysis, or averages for assessing overall load. This approach ensures both an objective big picture and detailed insight for incident investigation.
*The 95th percentile is the value above which only 5% of the highest traffic measurements for the selected period are found.
