Demo — www.example.com
Assign. 5 rules triggered across 2 domains. 2 rules could not be scored. Score 62.
Score landed in escalate-severity band with 5 rules triggered.
What this report says
Score 62 — 5 rules triggered in Cache busting.
Triggered: Query String Diversity High, Query String Diversity With High Miss Rate, Volume Delta High, and 2 more. 2 additional rules could not be scored due to missing inputs — treat the score as a floor on risk, not a complete picture.
The selected host is the top-ranked scorecard entity because cache-busting and movement rules crossed thresholds. Treat the finding as a prioritization cue: validate query-string behavior and cache policy before attributing cause or changing controls.
5 rules crossed threshold
-
Query String Diversity High Cache busting −16 pts
Query-string diversity ratio is 0.82.
- Observed
- 0.82%
- Threshold
- 0.50%
querystring_diversity_high -
Query String Diversity With High Miss Rate Cache busting −18 pts
High query-string diversity coincides with 64.00% cache misses.
- Observed
- 0.82%
- Threshold
- 0.50%
- Cache miss pct
- 64.00%
- Cache miss threshold
- 50.00%
querystring_diversity_with_high_miss_rate -
Volume Delta High Movement −12 pts
Request volume increased by 180000 (150.00%).
- Observed
- 300000.00%
- Threshold
- 100.00%
- Prior window
- 120000.00%
- Absolute delta
- 180000.00%
- Pct change
- 150.00%
volume_delta_high -
Bot Share Delta High Movement −8 pts
Bot share increased by 18 percentage points.
- Observed
- 42.00%
- Threshold
- 10.00%
- Prior window
- 24.00%
- Δ vs prior window
- +18.00pp
bot_share_delta_high -
Cache Miss Delta High Cache busting −8 pts
Cache miss rate increased by 22 percentage points.
- Observed
- 64.00%
- Threshold
- 15.00%
- Prior window
- 42.00%
- Δ vs prior window
- +22.00pp
cache_miss_delta_high
Investigations to queue from this report
-
Review mover attribution for the same scope and confirm comparable current/baseline windows.
-
Inspect query-string diversity, cache-key behavior, and cache miss concentration by host and path.
-
Regenerate aggregate rows with SIEM and origin-latency fields if security or origin-impact review is required.
Coverage detail 2 rules unscored
Rules listed below were not scored because their inputs are absent from the source row. They are not scored as safe.
Origin impact
-
origin_p95_delta_high— missing: current_origin_p95_ms, baseline_origin_p95_ms
Security evidence
-
siem_blocked_present— missing: siem_blocked_requests
What this report is and isn't
Rule-based scorecard for Demo · Akamai, built from mechanical features only, compared against previous window. It reports what was measured, not why. Missing feature inputs are reported as such — they are not scored as safe.
Schema, source table, and constraints
- Schema
bot_entity_scorecard.v1- Comparison
- Previous window
- Producer limit
- 20 (returned 1, truncated: false)
- Tenant / database
- Demo · Akamai
- Table
akamai.bi_summary_hour- Constraints
- Rule-based scorecard; Mechanical features only; No causal claim; LLM may summarize structured evidence only
- Confidence reasons
- Baseline window has enough rows; Current window has enough rows; Some feature inputs missing; Dimensions fit retained schema; Summary table used
Orientation — what this report measures
A health score for one request host on a 0–100 scale. The host starts at 100 and loses points when mechanical signals — cache-miss rate, query-string churn, error rate, bot-share movement — cross thresholds. The current window is compared with the prior equivalent window.
Higher is healthier (100 = clean); lower = more triggered rules. Bands: escalate 0–40, monitor 40–70, observe 70–100.
- escalate · 0–40
- monitor · 40–70
- observe · 70–100
Not a root-cause diagnosis or a malicious-traffic call. Missing inputs are reported as missing — they are not scored as safe.