CyberLiveMonitor Pro is the control room for the Magen Cyber Shield firewall. It reads your defence log in real time, plots every attacker on a live globe, classifies 23 attack types, and uses AI to explain exactly what was attempted against you - and why it was blocked.
No agent to install · No database server · Full Hebrew & English
Your firewall blocks hundreds of intrusion attempts a day - but without a screen you never learn about a single one of them. CyberLiveMonitor turns that dry log file into a picture you grasp in a second: who attacked, from where, what they tried, and whether we stopped them.
MCS writes firewall.log in a strict 20-field schema. The monitor pulls the file through a token-gated bridge, parses each line into an event object, runs it through a classification layer (detectAttack → _mcsAttackInfo) that maps modules, signals and reputation chains onto 23 documented attack types, and streams the result into 24 reactive panels - all client-side, with no server-side pre-processing stage.
Every number on screen is clickable. Click it and you get a plain-language explanation of what it means, why it matters, and what to do next.
Every stat card carries a help tooltip, and clicking it opens a drill-down with the raw records behind the number - IP, country, path, User-Agent, blocking module and risk score.
Running five sites? All of them on one screen, with fast switching. A setup wizard walks you through the first site step by step.
Each site gets an isolated data space (site_data keyed by site/category/name): configuration, alert thresholds, cached geo, AI history and an online-users snapshot. The site id is derived automatically from the domain.
Not a partial translation. Every word, report and tooltip exists in both languages, and the writing direction flips correctly.
The CSS is built on logical properties (margin-inline, start/end), so RTL/LTR flips without a second stylesheet. Translations live in the data layer (the i18n table) and are editable from the UI, with he.json/en.json as the initial seed.
Not a diagram and not a mock-up - the dashboard itself, with data flowing through it. Every panel opens, closes and drags to wherever suits you.
My server
| Time | IP | Country | URL | Attack type | Status |
|---|---|---|---|---|---|
| 13:33:11 | 203.0.113.42 | US | /wp-login.php | User Enumeration | Blocked |
| 13:33:06 | 198.51.100.17 | DE | /.env | Honeypot Trigger | Blocked |
| 13:32:58 | 192.0.2.88 | NL | /index.php?id=1 | SQL Injection | Blocked |
| 13:32:41 | 203.0.113.9 | IL | /products/overview | Verified Bot | Allowed |
| 13:32:19 | 198.51.100.204 | CN | /admin/config.bak | Scanner Tool | Blocked |
| 13:31:52 | 192.0.2.150 | FR | /shell.php | Web Shell Upload | Blocked |
The view below is a live reconstruction of the dashboard, built in HTML and CSS. Its data is illustrative only: the IP addresses come from the reserved documentation ranges (RFC 5737) and the domain is an example domain - no real customer data is shown here.
This is not a static map, and not a report generated at the end of the day. Every attack appears on the world map the moment it happens - a glowing dot at the attacker’s geographic location, with an arc drawn from it to your server. You watch the global picture develop in front of you, and the map opens to full screen.
Every panel opens, closes, drags to a new position and stays exactly where you put it. This is your view - not someone else’s.
Every attacker appears as a glowing dot on the world map, with an arc drawn to your server. Full screen in one click.
Canvas rendering with accurate geolocation, a separate server marker, view modes persisted to localStorage, and a per-dot tooltip carrying IP, country, module and risk score.
See the rhythm at a glance: how many requests came in, how many were blocked, how many were suspicious - by hour, day, week or month.
Chart.js with four series (blocked / allowed / suspicious / dry-run) bucketed into 10-minute slots across five time ranges. Legend labels are translated in the tooltip callback so they never go stale.
One click and the AI reads every recent attack, then hands you an organised report: what happened, what is worrying, what to do.
Two providers (Claude / Gemini), three analysis-depth levels and three report-length levels, per-site analysis history, PDF export. Keys live server-side only and never reach the browser.
A table of every request with search, sort and filters - expand a row for the full raw detail.
Per-column sorting, advanced filters, pagination, hardened CSV export, and a responsive layout that fits any window width. Every attacker-controlled field is escaped before display.
Who is on your site right this second - real visitors and active attackers, side by side.
A 5-second refresh over a configurable window, legitimate traffic separated from live attackers, a server-side snapshot, and an option to hide your own IP from the view.
One dial that sums up the situation: how dangerous it is right now, relative to what is being blocked and how fast.
An SVG gauge weighing block ratio, request rate over the last five minutes and unique attacker count into a graded threat level, coloured dynamically from the active theme.
Two complementary readings: how well the defence is working, and how varied the attackers trying it are.
The defence gauge shows block efficiency over a chosen window; the diversity gauge measures IP and country spread - high spread indicates a distributed scan rather than a single attacker.
Which pages on your site are attacked most - and what each of those pages actually is.
Every observed path aggregated with hit counts, automatic server-side page-title resolution (first 64KB, real status checked so error-page titles are never cached), and a full drill-down view.
The geographic picture: which parts of the world your traffic comes from, and where the attacks come from.
Aggregation by country and region with flags, live Cloudflare range detection for diagnosing real addresses behind a CDN, and per-country geo-block state.
Six automatic insights: peak hour, busiest IP, bot percentage, most common attack type and more.
Insight cards derived in real time from the active window - peak hour, top IP, bot ratio, dominant attack class, request rate and unique country count - each with a drill-down to the underlying records.
CPU, memory and disk load on your server - in real time, with nothing installed on it.
OS-accurate measurement (/proc/stat delta on Linux, PerformanceCounter on Windows), with core detection and a sampling interval set from the settings panel.
Arrange the panels exactly how you like, pick a colour scheme - and it all persists.
Eight themes (Dark, Nebula, Matrix, Inferno, Solar, Abyss, Light, Paper) defined as RGB triplets in CSS variables, so switching recolours canvases and gauges too. Panel order drags via SortableJS and is stored per user.
The MCS firewall sits on your server and stops attacks. The monitor is its eyes: it reads the defence log through a secure bridge protected by a secret token, and shows you live everything the firewall did.
The firewall.log schema is locked at 20 fields and never changes - new detections arrive as new values inside existing fields, never as new fields. The monitor covers both MCS operating modes: in merged mode every signal for a request is packed into the pattern= field of a single [DETECT] [REPUTATION] line and a resulting block carries MODULE=REP:<sub>; in per_signal mode each signal arrives as its own line. Both paths are parsed.
.bridge-token is generated at install time, sits next to the log, and never enters source-control history. Without it - 403.
An .htaccess in the log folder rejects any direct request for .log/.txt/.json/.csv. The script is the only way in.
Each cycle starts with a HEAD request returning only size and Last-Modified. If the log did not grow, nothing is downloaded.
CORS is emitted by Apache alone, after double-clearing both header tables. PHP never adds its own - otherwise the browser sees *, * and rejects the response.
The system does not just say “blocked”. It tells you exactly what was attempted, how dangerous it is, and what you should do about it - in plain language.
Every type carries a full record: icon, bilingual label, severity, a 0-10 risk score, a description of the detection mechanism at module and signal level, the business-risk statement, and a list of operational recommendations. Classification runs per line at parse time.
sqli_attack
An attempt to run database commands through an input field - including inside a JSON body.
xss_attack
Injecting a script that would execute in other visitors’ browsers.
lfi_attack
Attempting to read server files through path manipulation.
webshell_attack
Attempting to plant a file that grants the attacker remote control of the server.
aggregation
MCS accumulated signals on one IP; crossing the threshold blocks the next request.
campaign_scan
Four or more IPs from different networks hit the same path within 15 minutes.
rate_flood
Abnormal request rate from one source - a load or resource-exhaustion attempt.
ua_rotation_sig
One IP cycling four or more browser fingerprints in five minutes - an evasion signature.
spoofed_bot
Claims to be Googlebot, but rDNS does not confirm the claim.
HEADER-ANOMALY
A header combination no genuine browser would ever send.
SCAN-VELOCITY
Path-to-path speed that indicates automated mapping rather than browsing.
honeypot_hit
A request to a decoy path no legitimate visitor should know exists.
scanner_tool
The signature of a known automated scanning tool.
user_enum_sig
A systematic attempt to discover which usernames exist.
geo_block
Origin in a country your policy marked for blocking.
cloud_provider
Traffic from a datacentre rather than a home network - usually automation.
rep_prior_block
The IP was blocked before the request was processed, on accumulated reputation.
ua_rotation_module
The same detection, arriving as a standalone module rather than a chain signal.
aggregate_module
The MCS synthetic engine that spots cross-IP patterns.
hp_learn_suspect
Learning telemetry - a candidate for future blocking, not an actual block.
direct_probe
A request to the raw IP instead of the domain - a clear scanning tell.
apache_race
Apache already blocked the request before MCS could handle it.
legit_bot
A legitimate crawler confirmed by rDNS - counted, never blocked.
The list grows with every MCS release. New detections arrive as new values inside existing fields - so they never break an existing parser.
A tool that concentrates all of your attack intelligence is itself a target. Every layer here was built on the assumption that someone is already trying to get in.
Threat model: an anonymous attacker from the internet, an attacker with internal-network access, and malicious content deliberately planted inside the attack log itself to hit whoever views it. All three vectors are handled explicitly.
No sign-in, no data. Full stop.
The allowlist holds six actions only (config, auth-login, auth-check, auth-logout, auth-google, i18n). Each of the remaining 26 returns 401 without a valid session token - including those that return API keys, delete a site or reset the system.
Your password is never stored as-is, and the session is only remembered if you asked for it.
Verification via password_verify against a hash, a 32-byte cryptographic token (random_bytes) rendered as 64 hex characters, sliding renewal written at most once an hour, and a 7-day TTL with “remember me” versus 12 hours without. A failed login sleeps one second to slow brute force.
You can sign in with Google, but only if an administrator already created your account.
The identity token is verified server-side against Google, with explicit checks on aud (must be our client id), iss and email_verified. The address is matched to an existing account only - never auto-created, and that is a deliberate policy choice.
The system refuses to fetch a URL that points back into your own network.
Schemes are restricted to http/https, every host is resolved and checked against private, loopback and link-local ranges (including cloud metadata at 169.254.169.254), and 3xx redirects are disabled outright - because the guard only validated the original target.
An attacker can write code into your log. Here it is displayed as text - never executed.
Every attacker-controlled field (User-Agent, path, pattern, reason) is escaped across all render paths, and CSV export is hardened against formula injection. An attack log is, by definition, an adversary-controlled input channel.
Internal files are simply not reachable from a browser.
An .htaccess blocks any path containing a dot-prefixed segment (except .well-known), with a FilesMatch fallback for hosts without mod_rewrite, and Options -Indexes prevents directory listing. Without it, .git/ is exposed - and from there the full source and history can be reconstructed.
The database cannot be downloaded, not even by guessing the filename.
data/.htaccess applies Require all denied to the whole directory, and on top of that explicitly blocks the data files themselves along with .php and .json - belt and braces in case a host configuration ignores the first rule.
Your AI keys never leave the server.
Keys are read from environment variables or protected storage and injected into the outbound call on the server. The browser sends an analysis request and receives text back. It never sees a key, an endpoint or an authorization header.
One public entry point, one data layer, zero build dependencies. That is what lets the whole system deploy onto ordinary shared hosting in minutes.
Everything in one place: a single data file with seven tables. No database server to install, no DB password to manage, and a backup is one file copy.
An embedded, file-based database living inside data/ - a directory sealed off from browser access entirely. It runs with write-ahead journaling, busy_timeout=5000 and foreign-key enforcement. The file is created and seeded automatically on first access, so deployment needs no manual migration step, and every write runs in a transaction with rollback.
usersAccounts: name, email, password hash, avatarsessionsActive tokens with expiry and TTLsitesMonitored sites, in display ordersettingsSystem preferences, key to valuei18nTranslations by language and keysite_dataPer-site config / cache / logsapp_storeAI settings, attack rules, keys, CF rangesThirty-two actions - and only six of them are reachable without signing in. Everything else returns 401 to anyone without a valid token.
config
ai-settings
save-ai-settings
reset-ai-settings
i18n
save-i18n
ai
auth-login
auth-check
auth-google
auth-logout
auth-users
auth-save-user
auth-delete-user
proxy-diagnose
geo
dns
resolve-site
site-data
create-site
delete-site
verify-reset
load-keys
save-keys
get-key
get-all-keys
load-settings
save-settings
load-rules
load-sites
save-sites
check-log
fetch-title
server-hardware
No dedicated server, no Docker, no database to install. Ordinary shared hosting with PHP is entirely enough.
The floor is PHP 8 with the required standard extensions and curl, plus a writable data/ directory (755) - the data layer needs write access even for read-only use, because of schema creation and journaling. If the permission is missing, every endpoint returns an explicit JSON error naming the cause instead of an opaque 500.
The dashboard shows how loaded your server is right now - CPU, memory and disk - without installing any extra software on it.
On Linux, CPU comes from a /proc/stat delta between two samples 250ms apart - exactly what top reports - rather than sys_getloadavg(), which measures run-queue length including I/O wait and lags by up to a minute. On Windows the source is PerformanceCounter('Processor','% Processor Time','_Total'), the same counter Task Manager reads, falling back to WMI only if PowerShell is locked down.
Copy the files to the server. No compilation, no npm install, no migration.
The data/ directory must be writable (755). This is the single most common first-deploy failure.
On first access the data file is created, the schema is built and default translations are loaded.
Two files and one folder go onto the monitored server, and the token is generated automatically at install.
The setup wizard walks you through three stages. There is no configuration file to hand-edit.
The wizard identifies the domain, resolves the server IP and locates it geographically - all automatically.
The wizard shows the full installation instructions right here: which files to upload and exactly where. The secret token generates itself, and a test button confirms the connection before you continue.
Display name, identifying colour, log format and alert thresholds. Every site gets its own sensitivity settings.
Within seconds the screen fills: attack dots on the globe, a live chart, a streaming log and threat gauges that update on their own.
Almost nothing. You upload one bridge file next to the log, plus an .htaccess that blocks direct access to it. There is no background agent, no service to supervise and no continuous resource cost.
The exact instructions arrive while you are setting up the connection to a new site - the wizard shows you which files to upload, precisely where each one goes, and generates the secret token for you. There is no external documentation to hunt down.
Entirely with you. A single data file on your own server holds everything - users, sites, settings and translations. There is no external cloud, no third-party service holding your attack intelligence, and a full backup is one file copy.
They stay on the server and are never sent to the browser. The browser requests an analysis, the server makes the call to Claude or Gemini with its own key, and returns text only. Even someone with developer tools open will not see a key.
Yes, and there is a dedicated tool for it. The system pulls Cloudflare’s current address ranges and diagnoses whether the address you are seeing belongs to the real visitor or to the CDN - so you never chase a proxy IP instead of the attacker.
It is deliberate. A system that concentrates an organisation’s entire attack intelligence is an obvious target, so accounts are created by an administrator only. Google sign-in likewise requires that the email already belongs to an existing account.
Minutes. No compilation, no package installation, no database to provision. Upload the files, make sure the data directory is writable, and the system builds itself on first access.
Yes, with no built-in limit. Each site gets its own isolated data space - configuration, alert thresholds, AI analysis history and cache - and switching between them is a single click.
Both, completely. Every interface string, report and tooltip is translated, and the writing direction flips automatically. The translations themselves are editable from the UI without touching code.
Sign in with your account and see the full picture of what is happening to your servers - right now.
Sign in to the consoleNo account? Accounts are created by an administrator - there is no self-registration.
Welcome to CyberLiveMonitor. Use of the site and the system (the "Service") is subject to the terms below. Browsing and using the Service constitutes full acceptance of these terms. If you do not agree with any of them, please refrain from using the Service.
CyberLiveMonitor is a monitoring and display tool for the Magen Cyber Shield firewall. It presents information about traffic and attack attempts recorded on a server under your control. The Service is not itself a firewall, does not block attacks, and is not a substitute for protective measures, backups or professional information-security advice.
All rights in the Service and its content - design, graphics, code, text, logo and any other material - belong exclusively to Ronen Peleg, the operator. You may not copy, reproduce, modify, distribute, reverse-engineer or commercially exploit the Service, in whole or in part, without prior written permission.
Access to the system requires an account created by an administrator. There is no self-registration. You are responsible for keeping your credentials confidential and for all activity performed under your account. Notify the operator immediately of any suspected unauthorised use.
You undertake to use the Service in good faith, in accordance with all applicable law, and solely to monitor servers and sites that you own or have explicit permission to monitor. Monitoring third-party assets without authorisation, interfering with the Service or its security, and using information obtained through it for any harmful act are strictly prohibited.
The Service may rely on external providers for artificial-intelligence analysis and for geolocating IP addresses. Their use is subject to their own terms and privacy policies, and the operator is not responsible for their availability, accuracy or behaviour.
The Service and the information it displays are provided "AS-IS", without warranty of any kind. The operator is not responsible for the accuracy, completeness, availability or continuity of the information; does not guarantee that every attack will be detected, correctly classified or displayed; and is not liable for any direct, indirect, consequential or other damage arising from use of or reliance on the Service. Reliance on the information is at your sole risk.
The operator may change, suspend or discontinue the Service or parts of it at any time, including for maintenance, without prior notice.
You undertake to indemnify the operator for any damage, loss or expense arising from your breach of these terms or misuse of the Service.
The operator may update these terms from time to time. The updated version takes effect upon publication on the site.
These terms are governed exclusively by the laws of the State of Israel, and the courts of Tel Aviv-Yafo have sole jurisdiction.
Questions about these terms: ronenpg@gmail.com.
Your privacy matters to us. This policy explains what information is collected on the public site and within the system itself, how it is used and how it is protected. Because CyberLiveMonitor is a security product that processes attack logs, the policy explicitly distinguishes between two kinds of information.
The public site runs no tracking systems, uses no advertising cookies and shares nothing with ad networks. It keeps only technical local storage on your device: your language preference, your chosen detail level (simple/technical), your accessibility settings, and the fact that you dismissed the privacy notice. This stays on your device, is never sent to a server and does not identify you personally.
Access to the system requires an account. For that purpose we store a username, display name, email address and a profile image if uploaded. Passwords are never stored as text, only as a one-way hash that cannot be reversed. Active session tokens with an expiry time are also stored.
The system displays traffic logs from the servers you choose to monitor. By their nature these logs contain visitors' and attackers' IP addresses, browser identifiers, requested paths and access times. This information is yours and is stored only on your own server, in a directory sealed off from direct browser access. It is not transmitted to the Service operator and is not stored in any external cloud. Responsibility for lawful use of this information, including any obligations you owe to visitors of your own sites, rests with you.
Cookies and local storage are used for operational purposes only: maintaining your session, display preferences and accessibility settings. There are no marketing cookies, cross-site tracking or profiling. You can block cookies in your browser settings; doing so will prevent signing in.
Below is every external party information may reach, what reaches each of them, and when. All but the last are triggered by an action you take or a feature you enable, and can be avoided by not using that feature.
Fonts are hosted by us. Neither this site nor the system loads fonts from Google Fonts. Every font file is served from the installation's own server, so merely browsing does not transmit your IP address to Google or to any other third party. Every transfer listed above depends on an action you take.
No password, no session token and no complete attack log is transmitted to any of these parties.
API keys for the AI and geolocation services are yours, are stored in the protected data directory on your own server, and are loaded into the signed-in user's browser so that some calls can be made directly from it. This means the keys are exposed to anyone with access to a signed-in monitor account, so access to the system should be granted only to people authorised to use those keys.
Your relationship with the AI and geolocation providers is direct, through your own key, and their terms of service and privacy policies apply to you. A full account of every service is in the notices document shipped with the installation, at licenses/THIRD-PARTY-NOTICES.md.
We do not sell, rent or trade your information. Sharing occurs only as required to provide the Service, to comply with the law, or to lawfully protect our rights.
The system was built assuming it is itself a target: every endpoint sits behind an authentication gate, the data directory is entirely sealed from browser access, internal files are unreachable from the internet, and any attacker-originated content is treated as text and never executed. Even so, absolute protection cannot be guaranteed.
Information is retained while the account is active or as long as needed to operate the Service and comply with the law. Expired session tokens are deleted automatically.
Under the Israeli Protection of Privacy Law, 5741-1981, you may review the personal information held about you and request its correction or deletion by contacting us by email.
We may update this policy from time to time. The updated version will be published on this page and takes effect upon publication.
Privacy questions: ronenpg@gmail.com.
We believe the site should be available and clear to every user, and we work to make it accessible to the best of our ability, in line with the Israeli Equal Rights for Persons with Disabilities Law, 5758-1998, and the accessibility service regulations.
We aim to meet the Israeli standard IS 5568 and the international WCAG 2.1 Level AA guidelines, and we improve the site continuously.
An accessibility button in the corner of the screen opens a personal-adjustment menu offering:
Your preferences are saved on your device and continue to apply on every visit until reset.
The site was tested automatically with the axe-core engine against the WCAG 2.0 and 2.1 Level AA criteria, and manually: full keyboard-only navigation, verification that the focus indicator is visible on every control, display enlargement to 200% and 400%, computed contrast of every piece of text against the colour actually behind it, and behaviour under the "reduced motion" preference.
Testing was performed in Chrome on Windows, in both interface languages (Hebrew and English), at viewport widths of 1280, 640 and 320 pixels. The date of the most recent test appears at the foot of this statement.
We continue to fix and improve, and welcome feedback.
No accessibility exemption has been sought or granted for this site, whether on grounds of disproportionate burden or of technical infeasibility.
The service is provided online only. There are no physical premises used to receive the public, and therefore no physical accessibility arrangements to report.
Encountered an accessibility problem on the site? We would like to know, and to fix it.
We will handle your enquiry promptly and get back to you.
CyberLiveMonitor Pro is a proprietary product of Ronen Peleg. Alongside the code written for it, the product makes use of the third-party components listed here. Each belongs to its respective owner and is included under the licence shown beside it; nothing in this list derogates from their rights.
The product is licensed, not sold. It is currently supplied at no charge, but that does not make it free software, open source or public domain: all rights in it are reserved, and there is no permission to copy, redistribute, sell or pass it on to a third party. Supplied without charge is not the same as free to pass on.
The operator may set a licence fee for future versions. Such a change will not affect a licence already granted, but neither does it entitle anyone to receive new versions, updates or support at no charge. The full licence terms are in LICENSE.txt, delivered with every installation.
The MIT License is permissive: it allows use, modification, distribution and sale on one condition, that the copyright notice and the licence text accompany every copy. That condition is met by the licenses/ folder included in every installation.
Orbitron, Heebo, Share Tech Mono, Assistant, Rubik, Noto Sans Hebrew, IBM Plex Sans Hebrew, Secular One and Suez One are all licensed under the SIL Open Font License, Version 1.1, which expressly permits fonts to be embedded, redistributed and sold together with software. The full per-family copyright notices are in licenses/Fonts-Copyright-Notices.txt.
The font files are served from this site's own server and are not loaded from the Google Fonts service. What that means for you as a visitor: simply opening a page does not transmit your IP address to Google. The files are kept in their original form, unmodified and with no characters removed, as is required to preserve the Reserved Font Names the licence protects.
While running, the system may contact external services for AI analysis, IP geolocation, font delivery and sign-in. Calls to the AI and geolocation providers always carry the API key of the installation operator, so the contractual relationship with those providers is directly theirs and those providers' terms apply to them. A full account of every service, its purpose and the data that reaches it is in the notices document shipped with the installation.
The complete licence texts accompany every installation in the licenses/ folder, and the document that gathers them all is licenses/THIRD-PARTY-NOTICES.md. For any question about rights or licensing, write to ronenpg@gmail.com.