Every time Imunify360 sees something suspicious, such as failed logins, a WAF rule match or a port scan, it records an incident. The Incidents log is where you learn what is attacking your server, which customers are affected and whether a block was a false positive.
MdmHost manages this on its hosting plans. This guide is for administrators of their own server with root access.
Before you start
- Imunify360 installed (see installing Imunify360).
- Root access to WHM and SSH.
Open the Incidents tab
- Go to WHM → Plugins → Imunify360 → Incidents.
- Each row shows time, IP address, country, a description (for example a ModSecurity rule message or "Brute-force attack"), the severity and how many times it happened.
- Filter by IP, time range or severity; search for a domain or rule ID.
Read common incident types
| Description | What it means | Typical action |
|---|---|---|
| Brute-force / ossec login failures | Repeated failed logins to cPanel, mail, FTP or SSH | Usually nothing; IP is grey-listed automatically |
| ModSecurity rule ID and message | A WAF rule blocked a request | Check for false positives on legitimate sites |
| WordPress login brute force | Many POSTs to wp-login.php or xmlrpc.php | Nothing, or advise the customer on login protection |
| Port scan / network attack | Probing of server ports | Nothing; blocked by the firewall |
From an incident to a decision
- The IP belongs to your customer or office and shows login failures: find the device with an old password; whitelist only if it is a fixed IP you control (see firewall lists).
- Many WAF hits for one legitimate site and URL: probably a false positive; add a narrow exception (see ModSecurity configuration).
- Repeated attacks from one network: blacklist the IP or subnet.
Use the CLI
imunify360-agent incidents list --limit 50
imunify360-agent incidents list --by-ip 203.0.113.10Options vary by version; see Imunify360 CLI commands. Add --json to feed incidents into your monitoring.
Tip: Review incidents weekly and look for trends rather than individual lines. A sudden rise in WAF hits on one domain often means a vulnerable plugin is being targeted.
Customer questions
When a customer says "I was blocked", search incidents for their IP from the IP checker. The description tells you whether it was failed logins, a WAF rule or reputation, and the user-side fix is in unblocking an IP.
Frequently asked questions
How long are incidents kept?
Imunify360 keeps incidents for a limited period configured on the server. Export them if you need long-term records.
Are all incidents attacks?
No. Many are customers with wrong saved passwords or legitimate requests matching a WAF rule. Context matters.
Can I get alerts for incidents?
Notifications can be configured for important events (see the Imunify360 permissions and notifications guide).
Why do I see incidents for IPs that are not blocked?
Not every incident triggers a block. Imunify360 counts events and blocks only when thresholds are reached or a rule is set to deny.