Event and Alarm Notification Types

After you onboard your service to EdgeOne, EO provides key events such as NS server taking effect, security attacks, and resource status changes for subscription. For specific subscription instructions, see Configure EdgeOne Event Alarms via TCOP. This document lists all alarm or notification event types currently supported by EO, along with their descriptions or triggers, and handling methods and recommendations.
Event List
Alarm Event
(Name)
Event Type
Event Description
Handling Method and Suggestion
DDoS Attack
DDoSAttack
EdgeOne detected that the IP address serving you is under a DDoS attack.
Pay attention to your service availability. Meanwhile, you can view the L3/4 DDoS Attack Protection Bandwidth metric card on the EdgeOne Console - Analytics page, click the DDoS Attack Event Count tab at the top, and view the corresponding attack event details.
DDoS Attack Causing Block
DDoSAttackBan
The IP address serving you has been blocked by the carrier due to a DDoS attack.
Please contact us for further processing.
HTTP Request Burst
HTTPRequestBurst
EdgeOne detected a sudden surge in HTTP requests for the domain, which is suspected to be an HTTP DDoS attack.
1. Monitor your service availability. You can also view recent traffic and request details on the EdgeOne Console - Analytics page to determine whether traffic spikes are part of normal business operations.
2. If you determine that the traffic spike is not part of normal business operations and the current security policy does not cover the characteristics carried by this attack, tighten the Web Protection Policy.
3. If you determine that the traffic spike is part of normal business operations, you can ignore this alarm. It is also recommended that you relax the Web Protection - Adaptive Frequency Control Limit Level or switch to observation mode.
Web Security Monitoring
WebSecurityMonitoringEvent
EO detected requests that hit the Web security monitoring rules. Such requests may constitute Web attacks that affect website security.
1. View attack details via Web Security Analysis.
2. Analyze the trigger cause based on the Web Security rule ID. If you need to adjust the alarm rule, see Web Security Monitoring Rules.
Suspected Bandwidth Abuse
(Detected Based on Reputation Database)
BandwidthAbuseBasedOnClientReputation
Abnormal access traffic matching IPs in the blacklist feature database has been detected, which is suspected to be bandwidth abuse. The detection has a T+1 day latency.
1. Check the traffic status of the corresponding domain to confirm whether there is any unexpected traffic surge.
2. If bandwidth abuse is confirmed, block the client IPs suspected of initiating the attack by using the Rule Engine - HTTP Response or Web Security - Basic Access Control feature.
3. Enable the Web Security - Bandwidth Abuse Protection to automatically protect against fraudulent activities.
4. Adjust the rule level of the Web Security - Adaptive Frequency Control feature to "Adaptive - Moderate" or "Adaptive - Emergency".
5. For large file resources, limit the access frequency by using the Web Security - Precise Rate Limiting feature.
6. Configure the Usage Capping Policy based on your business needs to automatically stop the domain service before high bills are generated.
7. For other mitigation measures (for example: Token authentication, UA allowlist/blocklist, rate limiting for suspicious UAs), see the EdgeOne Resource Abuse Practice Tutorial.
Managed Ruleset Update
WebSecurityManagedRulesNewVersion
A new version of the Web Security Managed Ruleset has been released, which may include new vulnerability protections or rule optimizations.
1. It is recommended that you log in to the EdgeOne console and view the new version rule description in the managed rules of the specific Web Security policy.
2. If the Auto Update feature is not currently enabled, evaluate whether you need to upgrade the current rule set to enhance security protection.
Origin-pull Node IP Address Change
IPAclCIDRsUpdate
A change in the EO origin-pull node IP address has been detected, which may affect the stability of the connection to the origin server.
1. Confirm whether the updated origin-pull node IP address is authorized by your origin server.
2. Please update your origin server firewall settings promptly by referring to Origin Protection(Obtaining/Updating Origin IP Address Range) to prevent business impact caused by origin failure.
NS Server Taking Effect
NSModificationTakenEffect
The site NS server you added in the EdgeOne console has taken effect.
This is a system notification, indicating that the DNS server has been updated. You can proceed to complete operations such as adding DNS records, accelerating domains, and configuring HTTPS certificates.
1. Configure DNS records. For details, see Configure Domain DNS Resolution Records.
2. Connect the domain to EO for acceleration. For details, see Add an Acceleration Domain.
3. Configure the HTTPS certificate. For details, see Quickly Implement HTTPS Access with a Free Certificate.
Domain Offline Heads-up Due to ICP Filing Expiration
DomainOfflineHeadsUpDue2IcpFilingExpiration
Your domain's ICP filing information is detected to be expiring soon, which may cause service interruption.
1. Handle the domain registration issue and complete the registration process by referring to the Registration Guide.
2. After domain registration is restored, resume the domain service via the EdgeOne console.
Domain Offline Due to ICP Filing Expiration
DomainOfflineDue2IcpFilingExpiration
The domain's ICP filing has expired or become invalid, and the related services have been suspended.
1. Handle the domain registration issue and complete the registration process by referring to the Registration Guide.
2. After domain registration is restored, resume the domain service via the EdgeOne console.
Site Acceleration Region Switch Due to ICP Filing Expiration
SiteAccelerationRegionSwitchDue2IcpFilingExpiration
The domain's ICP filing is abnormal, and the site acceleration service has been automatically switched to a restricted region (such as outside Mainland China).
1. First, resolve the ICP registration issue and complete the registration process by referring to the Registration Guide.
2. After registration is restored, manually switch the acceleration region back to the original region (such as Mainland China) via the EdgeOne console.
Site Violation Ban
SiteViolationBan
Your site has been banned by the system for violating the Terms of Service or laws and regulations.
If you have any objections, please submit a ticket to contact customer service for feedback and processing.
Account Violation Ban
AccountViolationBan
Your Tencent Cloud account has been banned due to severe violations. All EdgeOne site acceleration services under the account have been terminated, and you cannot add new sites.
If you have any objections, please submit a ticket to contact customer service for feedback and processing.
Usage Threshold Alarm
UsageThresholdAlarm
Current service usage has exceeded the alert threshold you set. If it subsequently reaches the upper limit threshold you configured, the domain will be stopped from service and return a 403 status code.
1. Please be aware of the impact of usage capping on your current service.
2. To adjust the usage capping threshold, see the Usage Capping Policy.
Usage Quota Limit Reached
UsageQuotaLimitReached
Current service usage has reached the upper limit you set, the service has been stopped, and domain requests will return a 403 status code.
1. To resume service, go to EdgeOne console > Domain Management and manually enable domain acceleration.
2. To adjust the usage capping threshold, see the Usage Capping Policy.
Extra Package Exhausted
AdditionalPackageExhausted
The extra package you purchased has been used up.
Please promptly monitor your extra package usage via the EdgeOne Console > Extra Package Management page.
Extra Package Expired
AdditionalPackageExpired
The extra package you purchased has expired.
Please promptly monitor your extra package usage via the EdgeOne Console > Extra Package Management page.
Extra Package Auto-Renewal
AdditionalPackageAutoRenew
The extra package auto-renewal feature you set up has been successfully executed or its status has changed.
1. (After successful renewal) Log in to the EdgeOne Console > Extra Package Management to check the validity period update status of the extra package and confirm the deduction records.
2. (Renewal failed) If the renewal fails due to insufficient account balance or other reasons, promptly top up your account and check the auto-renewal settings to avoid service disruption.
3. Manage the auto-renewal switch for extra packages in the EdgeOne Console > Extra Package Management.
Unused Plan Reminder
UnusedPlanReminder
The plan you purchased has not been enabled, is about to expire, or has not been fully utilized.
1. Log in to the EdgeOne console > Plan Management to check the package status and usage.
2. If you plan to use it, configure the relevant service as soon as possible.
Auto Downgrade to Free Plan Due to Non-Renewal
AutoDowngrade2FreePlanDue2NonRenewal
Your paid plan has been automatically downgraded to a free plan due to non-renewal.
1. The free package has limited features. We recommend that you log in to the EdgeOne console > Plan Management as soon as possible to upgrade your package and restore the benefits of your original paid package.
2. If you do not require a paid service, you can continue to use the Free Package, but please note the feature and quota restrictions.
Event content sample
DDoS attack
{
    "Id": "7000004864921762851218/176302069",
    "Source": "teo.cloud.tencent",
    "Type": "teo:ErrorEvent:DDoSAttack",
    "Subject": "edgeone-xxxx",
    "Region": "",
    "Status": "1",
    "Data": "{\"AppId\":1300224863,\"Uin\":\"700000486492\",\"AdditionalMsg\":[{\"Key\":\"attackType\",\"Value\":\"SYNFLOOD\"},{\"Key\":\"attackBandwidth\",\"Value\":\"152000000\"},{\"Key\":\"attackPacketRate\",\"Value\":\"38506\"},{\"Key\":\"alarmThreshold\",\"Value\":\"50000000\"}],\"Dimensions\":[{\"Key\":\"instanceId\",\"Value\":\"edgeone-xxxx\"},{\"Key\":\"instanceName\",\"Value\":\"\"},{\"Key\":\"instanceType\",\"Value\":\"L7\"}]}"
}
DDoS attack causes blocking
{
    "Id": "7000004864921762851218/176302069",
    "Source": "teo.cloud.tencent",
    "Type": "teo:ErrorEvent:DDoSAttackBan",
    "Subject": "edgeone-xxxx",
    "Region": "",
    "Status": "1",
    "Data": "{\"AppId\":1300224863,\"Uin\":\"700000486492\",\"AdditionalMsg\":[{\"Key\":\"isp\",\"Value\":\"\"},{\"Key\":\"dcType\",\"Value\":\"\"},{\"Key\":\"idcName\",\"Value\":\"\"}],\"Dimensions\":[{\"Key\":\"instanceId\",\"Value\":\"edgeone-xxxx\"},{\"Key\":\"instanceName\",\"Value\":\"\"},{\"Key\":\"instanceType\",\"Value\":\"L7\"}]}"
}
HTTP request surge
{
    "Id": "7000004864921762851218/176302069",
    "Source": "teo.cloud.tencent",
    "Type": "teo:ErrorEvent:HTTPRequestBurst",
    "Subject": "www.example.com",
    "Region": "",
    "Status": "1",
    "Data": "{\"AppId\":1300224863,\"Uin\":\"700000486492\",\"AdditionalMsg\":[{\"Key\":\"maxQps\",\"Value\":\"149\"}],\"Dimensions\":[{\"Key\":\"hostName\",\"Value\":\"www.example.com\"},{\"Key\":\"zoneId\",\"Value\":\"zone-36n5wwvjsft2\"}]}"
}
Web Security Monitoring
{
    "Id": "7000004864921762851218/176302069",
    "Source": "teo.cloud.tencent",
    "Type": "teo:ErrorEvent:WebSecurityMonitoringEvent",
    "Subject": "1762851218",
    "Region": "",
    "Status": "1",
    "Data": "{\"AppId\":1300224863,\"Uin\":\"700000486492\",\"SubAccountUin\":\"700000486492\",\"AdditionalMsg\":[{\"Key\":\"alarmRuleName\",\"Value\":\"autotest2171121362\"},{\"Key\":\"alarmCondition\",\"Value\":\"More than 1 request in 10 seconds\"},{\"Key\":\"currentValue\",\"Value\":\"3 requests in 10 seconds\"}],\"Dimensions\":[{\"Key\":\"hostName\",\"Value\":\"alarm-notification.example.com\"},{\"Key\":\"zoneId\",\"Value\":\"zone-36n5wwvjsft2\"},{\"Key\":\"alarmRuleId\",\"Value\":\"1762851218\"}]}"
}
Suspected fraudulent traffic (intelligence database detection)
{
    "Id": "bf1088f9-6419-4ebc-8a18-06cb547f1357",
    "Source": "teo.cloud.tencent",
    "Type": "teo:ErrorEvent:BandwidthAbuseBasedOnClientReputation",
    "Subject": "www.example.com",
    "Region": "",
    "Status": "-",
    "Data": "{\"AppId\":260057934,\"Uin\":\"700001968306\",\"SubAccountUin\":\"700001968306\",\"AdditionalMsg\":[{\"Key\":\"maliciousClientIp\",\"Value\":\"43.133.148.201\"},{\"Key\":\"abnormalTrafficGB\",\"Value\":\"22.00 GB\"},{\"Key\":\"statisticalPeriod\",\"Value\":\"2025-11-12T00:00:00+08:00 - 2025-11-12T23:59:59+08:00\"}],\"Dimensions\":[{\"Key\":\"hostName\",\"Value\":\"www.example.com\"},{\"Key\":\"zoneId\",\"Value\":\"zone-3iryagtfjimp\"},{\"Key\":\"zoneName\",\"Value\":\"example.com\"}]}"
}
Managed Ruleset Update
{
    "Id": "25b8a6a152b5d67a5c8e914f52f72f27",
    "Source": "teo.cloud.tencent",
    "Type": "teo:ErrorEvent:WebSecurityManagedRulesNewVersion",
    "Subject": "700001968306",
    "Region": "",
    "Status": "-",
    "Data": "{\"AppId\":260057934,\"Uin\":\"700001968306\",\"SubAccountUin\":\"700001968306\",\"AdditionalMsg\":[],\"Dimensions\":[]}"
}
Origin IP address Change
{
    "Specversion": "1.0",
    "Id": "89439a4f-aed4-4867-91eb-85640649951a",
    "Source": "teo.cloud.tencent",
    "Type": "teo:ErrorEvent:IPAclCIDRsUpdate",
    "Subject": "zone-2vqo81pu70m6",
    "Time": 1762135870202,
    "Region": "",
    "DataContentType": "application/json;charset=utf-8",
    "Status": "-",
    "Data": "{\"appId\":1300260191,\"uin\":\"700001030823\",\"subAccountUin\":\"700001030823\",\"additionalMsg\":[{\"key\":\"updateEffectTime\",\"value\":\"2025-09-17T09:30:00+08:00\"}],\"dimensions\":[{\"key\":\"zoneId\",\"value\":\"zone-2vqo81pu70m6\"},{\"key\":\"zoneName\",\"value\":\"example.com\"},{\"key\":\"zoneAliasName\",\"value\":\"default\"}]}"
}
NS Servers Take Effect
{
    "Specversion": "1.0",
    "Id": "fd6a5d2f-6641-4815-aa6b-5dac2ec50b05",
    "Source": "teo.cloud.tencent",
    "Type": "teo:ErrorEvent:NSModificationTakenEffect",
    "Subject": "zone-3if1pzd0tw1x",
    "Time": 1762135870202,
    "Region": "",
    "DataContentType": "application/json;charset=utf-8",
    "Status": "-",
    "Data": "{\"appId\":260072669,\"uin\":\"700002117633\",\"subAccountUin\":\"700002117633\",\"additionalMsg\":[],\"dimensions\":[{\"key\":\"zoneId\",\"value\":\"zone-3if1pzd0tw1x\"},{\"key\":\"zoneName\",\"value\":\"example.com\"}]}"
}
Domain Name Filing Expiration and Deactivation Warning
{
    "Data": "{\"additionalMsg\":[{\"key\":\"estimatedOfflineTime\",\"value\":\"2025-11-15T14:00:00+08:00\"}],\"dimensions\":[{\"key\":\"zoneId\",\"value\":\"zone-3iryagtfjimp\"},{\"key\":\"zoneName\",\"value\":\"example.com\"}],\"uin\":\"700001968306\",\"subAccountUin\":\"700001968306\",\"appId\":260057934}",
    "DataContentType": "application/json;charset=utf-8",
    "Id": "55789efd-ad76-4b48-8f5d-11525cca43c7",
    "Region": "",
    "Source": "teo.cloud.tencent",
    "Specversion": "1.0",
    "Status": "-",
    "Subject": "eba.example.com",
    "TagList": [],
    "Tags": "",
    "Time": 1763015162796,
    "Type": "teo:ErrorEvent:DomainOfflineHeadsUpDue2IcpFilingExpiration"
}
Domain Name Filing Expiration and Deactivation
{
    "Data": "{\"additionalMsg\":[{\"key\":\"offlineTime\",\"value\":\"2025-11-13T14:31:47+08:00\"}],\"dimensions\":[{\"key\":\"zoneId\",\"value\":\"zone-3iryagtfjimp\"},{\"key\":\"zoneName\",\"value\":\"example.com\"}],\"uin\":\"700001968306\",\"subAccountUin\":\"700001968306\",\"appId\":260057934}",
    "DataContentType": "application/json;charset=utf-8",
    "Id": "d5501e90-8aad-4cdb-803a-cbb5dae1c409",
    "Region": "",
    "Source": "teo.cloud.tencent",
    "Specversion": "1.0",
    "Status": "-",
    "Subject": "eba.example.com",
    "TagList": [],
    "Tags": "",
    "Time": 1763015734393,
    "Type": "teo:ErrorEvent:DomainOfflineDue2IcpFilingExpiration"
}
Site acceleration region switch caused by ICP filing invalidation
{            
    "Data":"{\"additionalMsg\":[],\"dimensions\":[{\"key\":\"zoneId\",\"value\":\"zone-3iryagtfjimp\"},{\"key\":\"zoneName\",\"value\":\"example.com\"},{\"key\":\"zoneAliasName\",\"value\":\"EB2\"}],\"uin\":\"700001968306\",\"subAccountUin\":\"700001968306\",\"appId\":260057934}",         
    "DataContentType":"application/json;charset=utf-8",       
    "Id":"23e324a0-169b-4c02-b084-bc0136e7348a",          
    "Region":"",
    "Source":"teo.cloud.tencent",
    "Specversion":"1.0",
    "Status": "-",           
    "Subject":"zone-3iryagtfjimp",         
    "TagList":[],          
    "Tags":"",        
    "Time":1763007014949,          
    "Type":"teo:ErrorEvent:SiteAccelerationRegionSwitchDue2IcpFilingExpiration"      
}
Site violation blocking
{
    "Data": "{\"additionalMsg\":[],\"dimensions\":[{\"key\":\"zoneName\",\"value\":\"example.com\"},{\"key\":\"zoneId\",\"value\":\"zone-3is7gpqljmz5\"},{\"key\":\"zoneAliasName\",\"value\":\"\"}],\"uin\":\"700001954684\",\"subAccountUin\":\"700001954684\",\"appId\":260056561}",
    "DataContentType": "application/json;charset=utf-8",
    "Id": "ebaa3b89-9bb3-4f40-9628-aab7e63bd1ee",
    "Region": "",
    "Source": "teo.cloud.tencent",
    "Specversion": "1.0",
    "Status": "0",
    "Subject": "zone-3is7gpqljmz5",
    "TagList": [],
    "Tags": "",
    "Time": 1762775200296,
    "Type": "teo:ErrorEvent:SiteViolationBan"
}
Account violation blocking
{
    "Data": "{\"additionalMsg\":[],\"dimensions\":[],\"uin\":\"700001954684\",\"subAccountUin\":\"700001954684\",\"appId\":260056561}",
    "DataContentType": "application/json;charset=utf-8",
    "Id": "69dc19ad-b008-4003-b308-9c6c495e41ac",
    "Region": "",
    "Source": "teo.cloud.tencent",
    "Specversion": "1.0",
    "Status": "0",
    "Subject": "700001954684",
    "TagList": [],
    "Tags": "",
    "Time": 1762778821822,
    "Type": "teo:ErrorEvent:AccountViolationBan"
}
Usage threshold alarm
{
    "Id":"87d13620-7b98-4ee3-b4d6-5e46886cdb4e",
    "Source":"teo.cloud.tencent",
    "Type":"teo:ErrorEvent:UsageThresholdAlarm",         
    "Subject":"www.example.com",    
    "Time":1761920881244,           
    "Region":"",         
    "DataContentType":"application/json;charset=utf-8",    
    "Status":"-",         
    "Data":"{\"appId\":260072669,\"uin\":\"700002117633\",\"subAccountUin\":\"700002117633\",\"additionalMsg\":[{\"key\":\"alarmThreshold\",\"value\":\"0.10MB\"}],\"dimensions\":[{\"key\":\"zoneId\",\"value\":\"zone-3gznp178343p\"},{\"key\":\"zoneName\",\"value\":\"example.com\"},{\"key\":\"hostName\",\"value\":\"www.example.com\"}]}"    
}
Usage triggered capping
{            
    "Id":"767c6ac3-bf78-4b40-a789-90cc09930ff6",          
    "Source": "teo.cloud.tencent",           
    "Type":"teo:ErrorEvent:UsageQuotaLimitReached",         
    "Subject":"www.example.com",           
    "Time": 1761920888317,           
    "Region":"",           
    "DataContentType":"application/json;charset=utf-8",            
    "Status":"-",           
    "Data":"{\"appId\":260072669,\"uin\":\"700002117633\",\"subAccountUin\":\"700002117633\",\"additionalMsg\":[],\"dimensions\":[{\"key\":\"zoneId\",\"value\":\"zone-3gznp178343p\"},{\"key\":\"zoneName\",\"value\":\"example.com\"},{\"key\":\"hostName\",\"value\":\"www.example.com\"}]}"    
}
Add-on pack exhausted
{
    "Specversion": "1.0",
    "Id": "a76c8818dd46f30a93cad495e94603df",
    "Source": "teo.cloud.tencent",
    "Type": "teo:ErrorEvent:AdditionalPackageExhausted",
    "Subject": "260057934",
    "Time": 1762956138166,
    "Region": "",
    "DataContentType": "application/json;charset=utf-8",
    "Status": "-",
    "Data": "{\"appId\":260057934,\"uin\":\"700001968306\",\"subAccountUin\":\"700001968306\",\"additionalMsg\":[],\"dimensions\":[]}"
}
Add-on pack expired
{
    "Specversion": "1.0",
    "Id": "c9304b0ef0889f676ca0dbd1eb246967",
    "Source": "teo.cloud.tencent",
    "Type": "teo:ErrorEvent:AdditionalPackageExpired",
    "Subject": "260057934",
    "Time": 1763038338302,
    "Region": "",
    "DataContentType": "application/json;charset=utf-8",
    "Status": "-",
    "Data": "{\"appId\":260057934,\"uin\":\"700001968306\",\"subAccountUin\":\"700001968306\",\"additionalMsg\":[],\"dimensions\":[]}"
}
Add-on pack auto-renewal
{
    "Specversion": "1.0",
    "Id": "31c58b7ee1c2533cd98ddb6c4191d464",
    "Source": "teo.cloud.tencent",
    "Type": "teo:ErrorEvent:AdditionalPackageAutoRenew",
    "Subject": "edgeone-3iwijc4lvy8s",
    "Time": 1763035780176,
    "Region": "",
    "DataContentType": "application/json;charset=utf-8",
    "Status": "-",
    "Data": "{\"appId\":260057934,\"uin\":\"700001968306\",\"subAccountUin\":\"700001968306\",\"additionalMsg\":[{\"key\":\"extraPackageType\",\"value\":\"Traffic package\"},{\"key\":\"extraPackageSpecs\",\"value\":\"10TB\"},{\"key\":\"extraPackageExpirationTime\",\"value\":\"12 months\"}],\"dimensions\":[{\"key\":\"resource-id\",\"value\":\"edgeone-3iwijc4lvy8s\"},{\"key\":\"autoRenewalResult\",\"value\":\"fail\"}]}"
}
Plan not used
{
    "Specversion": "1.0",
    "Id": "abe11650fa65e76b45699033a13673e5",
    "Source": "teo.cloud.tencent",
    "Type": "teo:ErrorEvent:UnusedPlanReminder",
    "Subject": "251437216a8b01ee0899e9b5c9f9508fc53f35c4e",
    "Time": 1763106192129,
    "Region": "",
    "DataContentType": "application/json;charset=utf-8",
    "Status": "-",
    "Data": "{\"appId\":251437216,\"uin\":\"700002198688\",\"subAccountUin\":\"700002198688\",\"additionalMsg\":[],\"dimensions\":[]}"
}
Plan not renewed automatic downgrade
{
    "Specversion": "1.0",
    "Id": "940621d33dde6bada2bcb374ce15e31e",
    "Source": "teo.cloud.tencent",
    "Type": "teo:ErrorEvent:AutoDowngrade2FreePlanDue2NonRenewal",
    "Subject": "251437216",
    "Time": 1763104715479,
    "Region": "",
    "DataContentType": "application/json;charset=utf-8",
    "Status": "-",
    "Data": "{\"appId\":251437216,\"uin\":\"700002198688\",\"subAccountUin\":\"700002198688\",\"additionalMsg\":[],\"dimensions\":[]}"
}
﻿

Alarm Event (Name)	Event Type	Event Description	Handling Method and Suggestion
DDoS Attack	DDoSAttack	EdgeOne detected that the IP address serving you is under a DDoS attack.	Pay attention to your service availability. Meanwhile, you can view the L3/4 DDoS Attack Protection Bandwidth metric card on the EdgeOne Console - Analytics page, click the DDoS Attack Event Count tab at the top, and view the corresponding attack event details.
DDoS Attack Causing Block	DDoSAttackBan	The IP address serving you has been blocked by the carrier due to a DDoS attack.	Please contact us for further processing.
HTTP Request Burst	HTTPRequestBurst	EdgeOne detected a sudden surge in HTTP requests for the domain, which is suspected to be an HTTP DDoS attack.	1. Monitor your service availability. You can also view recent traffic and request details on the EdgeOne Console - Analytics page to determine whether traffic spikes are part of normal business operations. 2. If you determine that the traffic spike is not part of normal business operations and the current security policy does not cover the characteristics carried by this attack, tighten the Web Protection Policy. 3. If you determine that the traffic spike is part of normal business operations, you can ignore this alarm. It is also recommended that you relax the Web Protection - Adaptive Frequency Control Limit Level or switch to observation mode.
Web Security Monitoring	WebSecurityMonitoringEvent	EO detected requests that hit the Web security monitoring rules. Such requests may constitute Web attacks that affect website security.	1. View attack details via Web Security Analysis. 2. Analyze the trigger cause based on the Web Security rule ID. If you need to adjust the alarm rule, see Web Security Monitoring Rules.
Suspected Bandwidth Abuse (Detected Based on Reputation Database)	BandwidthAbuseBasedOnClientReputation	Abnormal access traffic matching IPs in the blacklist feature database has been detected, which is suspected to be bandwidth abuse. The detection has a T+1 day latency.	1. Check the traffic status of the corresponding domain to confirm whether there is any unexpected traffic surge. 2. If bandwidth abuse is confirmed, block the client IPs suspected of initiating the attack by using the Rule Engine - HTTP Response or Web Security - Basic Access Control feature. 3. Enable the Web Security - Bandwidth Abuse Protection to automatically protect against fraudulent activities. 4. Adjust the rule level of the Web Security - Adaptive Frequency Control feature to "Adaptive - Moderate" or "Adaptive - Emergency". 5. For large file resources, limit the access frequency by using the Web Security - Precise Rate Limiting feature. 6. Configure the Usage Capping Policy based on your business needs to automatically stop the domain service before high bills are generated. 7. For other mitigation measures (for example: Token authentication, UA allowlist/blocklist, rate limiting for suspicious UAs), see the EdgeOne Resource Abuse Practice Tutorial.
Managed Ruleset Update	WebSecurityManagedRulesNewVersion	A new version of the Web Security Managed Ruleset has been released, which may include new vulnerability protections or rule optimizations.	1. It is recommended that you log in to the EdgeOne console and view the new version rule description in the managed rules of the specific Web Security policy. 2. If the Auto Update feature is not currently enabled, evaluate whether you need to upgrade the current rule set to enhance security protection.
Origin-pull Node IP Address Change	IPAclCIDRsUpdate	A change in the EO origin-pull node IP address has been detected, which may affect the stability of the connection to the origin server.	1. Confirm whether the updated origin-pull node IP address is authorized by your origin server. 2. Please update your origin server firewall settings promptly by referring to Origin Protection(Obtaining/Updating Origin IP Address Range) to prevent business impact caused by origin failure.
NS Server Taking Effect	NSModificationTakenEffect	The site NS server you added in the EdgeOne console has taken effect.	This is a system notification, indicating that the DNS server has been updated. You can proceed to complete operations such as adding DNS records, accelerating domains, and configuring HTTPS certificates. 1. Configure DNS records. For details, see Configure Domain DNS Resolution Records. 2. Connect the domain to EO for acceleration. For details, see Add an Acceleration Domain. 3. Configure the HTTPS certificate. For details, see Quickly Implement HTTPS Access with a Free Certificate.
Domain Offline Heads-up Due to ICP Filing Expiration	DomainOfflineHeadsUpDue2IcpFilingExpiration	Your domain's ICP filing information is detected to be expiring soon, which may cause service interruption.	1. Handle the domain registration issue and complete the registration process by referring to the Registration Guide. 2. After domain registration is restored, resume the domain service via the EdgeOne console.
Domain Offline Due to ICP Filing Expiration	DomainOfflineDue2IcpFilingExpiration	The domain's ICP filing has expired or become invalid, and the related services have been suspended.	1. Handle the domain registration issue and complete the registration process by referring to the Registration Guide. 2. After domain registration is restored, resume the domain service via the EdgeOne console.
Site Acceleration Region Switch Due to ICP Filing Expiration	SiteAccelerationRegionSwitchDue2IcpFilingExpiration	The domain's ICP filing is abnormal, and the site acceleration service has been automatically switched to a restricted region (such as outside Mainland China).	1. First, resolve the ICP registration issue and complete the registration process by referring to the Registration Guide. 2. After registration is restored, manually switch the acceleration region back to the original region (such as Mainland China) via the EdgeOne console.
Site Violation Ban	SiteViolationBan	Your site has been banned by the system for violating the Terms of Service or laws and regulations.	If you have any objections, please submit a ticket to contact customer service for feedback and processing.
Account Violation Ban	AccountViolationBan	Your Tencent Cloud account has been banned due to severe violations. All EdgeOne site acceleration services under the account have been terminated, and you cannot add new sites.	If you have any objections, please submit a ticket to contact customer service for feedback and processing.
Usage Threshold Alarm	UsageThresholdAlarm	Current service usage has exceeded the alert threshold you set. If it subsequently reaches the upper limit threshold you configured, the domain will be stopped from service and return a 403 status code.	1. Please be aware of the impact of usage capping on your current service. 2. To adjust the usage capping threshold, see the Usage Capping Policy.
Usage Quota Limit Reached	UsageQuotaLimitReached	Current service usage has reached the upper limit you set, the service has been stopped, and domain requests will return a 403 status code.	1. To resume service, go to EdgeOne console > Domain Management and manually enable domain acceleration. 2. To adjust the usage capping threshold, see the Usage Capping Policy.
Extra Package Exhausted	AdditionalPackageExhausted	The extra package you purchased has been used up.	Please promptly monitor your extra package usage via the EdgeOne Console > Extra Package Management page.
Extra Package Expired	AdditionalPackageExpired	The extra package you purchased has expired.	Please promptly monitor your extra package usage via the EdgeOne Console > Extra Package Management page.
Extra Package Auto-Renewal	AdditionalPackageAutoRenew	The extra package auto-renewal feature you set up has been successfully executed or its status has changed.	1. (After successful renewal) Log in to the EdgeOne Console > Extra Package Management to check the validity period update status of the extra package and confirm the deduction records. 2. (Renewal failed) If the renewal fails due to insufficient account balance or other reasons, promptly top up your account and check the auto-renewal settings to avoid service disruption. 3. Manage the auto-renewal switch for extra packages in the EdgeOne Console > Extra Package Management.
Unused Plan Reminder	UnusedPlanReminder	The plan you purchased has not been enabled, is about to expire, or has not been fully utilized.	1. Log in to the EdgeOne console > Plan Management to check the package status and usage. 2. If you plan to use it, configure the relevant service as soon as possible.
Auto Downgrade to Free Plan Due to Non-Renewal	AutoDowngrade2FreePlanDue2NonRenewal	Your paid plan has been automatically downgraded to a free plan due to non-renewal.	1. The free package has limited features. We recommend that you log in to the EdgeOne console > Plan Management as soon as possible to upgrade your package and restore the benefits of your original paid package. 2. If you do not require a paid service, you can continue to use the Free Package, but please note the feature and quota restrictions.