What is Threat State; what do the bands from No Attack to Active Attack describe?

Short answer

Threat State is the indicator in which TR7 reduces the DDoS measurements to a single value between 0 and 1 and divides it into five bands (terminology): No Attack (0–0.2), Low Activity (0.2–0.4), Possible Attack (0.4–0.6), Attack Detected (0.6–0.8) and Active Attack (0.8–1). The value is calculated from the pressure axes (the busiest single source, the spread of sources, hostile traffic; on the vService, also the total load); a single axis can carry the value at most to Possible Attack, and Attack Detected and above require at least two axes to rise at the same time; the traffic that the protection intervenes in raises the value only up to a ceiling that stays below the alarm band. The indicator does not apply any enforcement to traffic. It appears on the route table as the L4 DDoS Threat State panel and the L4 DDoS Live View strip, and on the Bot/DDoS protected vService as the DDoS & Threat State panel; on the vService, it can trigger a notification with State Band Notification.

Where It Is Used in TR7

Where	Field / label	What for
Left Monitor Panel → Route Tables & L4 DDoS → route table → Dashboard → Summary	The L4 DDoS Threat State and Threat Pressure Breakdown panels	The band of the route table and the axis the value comes from
Route table → L4 DDoS Live View	Threat strip (band, general percentage, axis badges)	Instant reading
Left Monitor Panel → Route Tables & L4 DDoS list	Primary Metric = L4 DDoS Threat State	Comparing the route tables by band
Left Monitor Panel → Bot/DDoS Protected vServices → vService → Dashboard → Summary	The DDoS & Threat State and Threat Pressure Breakdown panels	The band and the axis breakdown of the vService
Home → L7 DDoS & Threat Protection tab	The DDoS & Threat State table	The bands of all the protected vServices in a single table
vService → Bot/DDoS Management → Notifications	State Band Notification (Possible Attack, Attack Detected, Active Attack)	A notification when the value rises to the selected band or above it

Bands

Band	Value	What it describes
No Attack	0 – 0.2	There is no notable pressure on the measured axes.
Low Activity	0.2 – 0.4	There is activity; it is for information and cannot be selected as a notification trigger.
Possible Attack	0.4 – 0.6	At least one axis has risen meaningfully; it is the ceiling of a single-axis rise.
Attack Detected	0.6 – 0.8	At least two axes are witnessing at the same time.
Active Attack	0.8 – 1	Two axes read close to the ceiling at the same time.

• The value on the route table changes quickly while rising and more slowly while falling; when the attack ends, the panel stays high for a few measurements and comes down gradually.
• A gap in the chart does not mean "no pressure"; it means that no measurement could be made at that moment.
• In a cluster setup, the values of the two devices are not added up on the vService panels; the larger one is shown.
• The L4 and L7 indicators use the same band names and thresholds; the difference is the rules that feed them (the L4 rules of the route table or the Bot/DDoS protections of the vService).

Common Misconceptions

• "When Active Attack appears, traffic is blocked." Threat State is an indicator; the rules and the protections' own modes (Monitor, Block, Quarantine…) decide on traffic.
• "A configuration that blocks heavily takes the dashboard to an attack band." The traffic intervened in raises the value only up to a ceiling below the alarm band; the defense on its own cannot cause an attack to be declared.
• "No Attack means that there is no traffic at all." Ordinary traffic continues; No Attack shows only that there is no notable pressure on the axes.
• "A single source pushing the limit raises the value to Attack Detected." A single axis keeps the value in the Possible Attack band; the alarm bands require more than one axis to rise.

How it is done in the documentation

• L4 DDoS Protection · Terminology
• Route table Dashboard · L4 DDoS Threat State
• L4 DDoS Live View · The Threat Strip
• Bot/DDoS Dashboard · DDoS & Threat State
• Notifications · State Band Notification

Related questions

• What is a DDoS attack; at which layers does TR7 provide DDoS protection?
• What is the difference between L4 DDoS Protection and L7 DDoS Protection?
• What is a botnet; how does TR7 detect a distributed attack originating from a botnet?