Custom Tracking

The Custom Tracking monitor provides real-time visibility into all active custom tracking IDs. The monitor shows how each ID was formed, how long it has been active, and how it is being used across traffic flows. This helps administrators understand traffic patterns, validate policy behavior, and troubleshoot how identifiers appear in requests and responses.

To view the Custom Tracking data, go to Dashboard > Custom Tracking. If it is not available in the Dashboard menu, refer to Monitors for how to add a monitor.

Each entry in the Custom Tracking Monitor includes:

• Custom Tracking ID — The generated identifier created from the configured tracking parameters.

• Last Access IP — The most recent client IP associated with this tracking ID, useful for understanding who is generating activity.

• Creation Time — When the tracking ID was first generated.

• Last Access Time — The most recent request associated with this ID, helping identify active or dormant IDs.

• Last Server policy — The Web Protection Profile and server policy under which the tracking ID was generated.

• Parameters Used — The specific headers, cookies, parameters, or response values that contributed to the tracking ID. This helps confirm whether the expected attributes are present in traffic.

• Expiration Time — When the ID will be evicted from the in-memory hash table if no new activity occurs.

In addition to the detailed view, administrators can:

• Filter by Custom Tracking ID, Last Server Policy, or Last Access IP to narrow the results.

• Sort by Creation Time, Last Access Time, or Expiration Time to prioritize either new or recently active IDs.

• Delete selected IDs or clear all tracked entries when needed for testing or troubleshooting.

Attack and traffic logs also record the custom_tracking_id when available, allowing events to be traced back to entries in the monitor for full request correlation.

Limitations

Custom Tracking is designed for real-time visibility and correlation, and it has the following operational constraints:

• Tracking IDs are not persistent.

  They are stored in memory and are removed after restart or timeout. This module is intended for live monitoring rather than long-term history.

• No scoring or automated actions.

  Unlike Client Management, Custom Tracking IDs are not used to apply behavior scores or automatic mitigation.

• Capacity depends on platform resources.

  The number of IDs that can be tracked at once varies by model and deployment size. High-volume environments may reach the ID limit sooner.