/

Understand how Monitor actions work

Monitor actions define how your application responds when a protection module detects a threat. Each module can be assigned its own action, so you can log low-confidence detections, block confirmed attacks, and terminate the application for critical threats.

Action Types

SDK Actions

These actions are available in JSON configuration and the Configuration API. They execute inside the application at the point where the threat is detected.

ActionBehaviorUse Case
CloseTerminates the application immediatelyCritical threats on desktop/mobile (debugger attached, tampering detected)
LogRecords the incident and continues executionNon-critical threats, monitoring, analytics
BlockBlocks the request and returns HTTP 403Web/API attacks (SQL injection, XSS, path traversal)
EraseSecurely deletes sensitive data, then terminatesFinancial or healthcare applications on compromised devices
CustomExecutes your own async handlerSIEM integration, Slack alerts, custom escalation workflows
NoneDetects the threat but takes no actionDevelopment, testing, shadow mode before enforcing

Cloud Dashboard Actions

These actions are available when configuring Workflow Rules in the Cloud Dashboard. They extend the SDK actions with network-level responses.

ActionBehaviorUse Case
Log incidentRecords the incident with full forensic contextAudit trail, compliance, analytics
BlockBlocks the specific request or operationStop the attack in progress
Block sessionInvalidates the attacker's entire sessionPrevent the attacker from continuing with a different payload
Block IPBlocks all traffic from the source IP addressStop repeated attacks from the same origin

ByteHide Monitor workflow rules showing IF/THEN configuration for Command Injection and SQL Injection with Log, Block, Block session, and Block IP actionsClick to expand

You can combine multiple actions in a single Workflow rule. For example, a SQL Injection rule can Log the incident, Block the request, and Block the IP simultaneously.

Action Selection Guide

By Threat Severity

Threat SeverityDevelopmentStagingProduction
Critical (Debugger, Tampering)None / LogCloseClose
High (Jailbreak, Memory Dump)LogCloseClose / Erase
Medium (VM, Emulator)NoneLogLog / Close
Low (Clock Tampering, Cloud Metadata)NoneLogLog

By Application Type

Application TypeRecommended Actions
Desktop (Console, WPF, WinForms)Close, Log, Erase, Custom
Mobile (MAUI, Xamarin, Android, iOS)Close, Log, Custom
Web / API (ASP.NET, Node.js)Block, Log, Custom
IoT / On-PremiseClose, Log, Custom

Common Scenarios

ScenarioActionWhy
SQL Injection on a public APIBlockStop the attack, keep the application running for other users
Debugger attached in productionCloseImmediate shutdown to prevent reverse engineering
VM detected on desktop appLogTrack for analytics without disrupting legitimate users on VMs
Jailbreak on a banking appCloseRegulatory requirement, compromised device cannot be trusted
Tampering detected with sensitive dataEraseDelete credentials and keys before shutting down
New protection in shadow modeNoneObserve detections before enforcing in production
Any threat on a monitored APILog + Block + Block IPFull Cloud Dashboard workflow: record, stop, and ban the source

Configuring Actions

Actions can be assigned per protection module from any configuration source:

  • Cloud Dashboard: Assign actions in Workflow rules with the IF/THEN editor. Supports all cloud actions including Block session and Block IP.
  • JSON Configuration: Set the action field per protection in your configuration file.
  • Configuration API: Pass the action type when registering protections in code.
JSON
{
  "protections": {
    "SqlInjection": { "enabled": true, "action": "block" },
    "DebuggerDetection": { "enabled": true, "action": "close" },
    "VirtualMachineDetection": { "enabled": true, "action": "log" }
  }
}

See JSON Configuration for the full schema reference.

Next Steps

Protection Modules

All available protection modules and what they detect

Custom Actions

Create custom response handlers for enterprise workflows

Cloud Configuration

Configure Workflow rules with Block session and Block IP actions

JSON Configuration

Full schema reference for per-module action configuration

Previous
Anomaly Detection
Next
Close