Iris
Add to Discord

Anti-Raid

Detect raids and lock down the server automatically.

Configure Anti-Raid in the dashboard

Overview#

Anti-raid watches two things: a burst of brand new accounts joining together, and a wave of different accounts posting the same thing at once. Iris reacts in seconds rather than whenever a moderator wakes up.

Rate on its own is never enough. A join only counts towards a raid if the account is younger than your account age setting or still has a default avatar, and most of the burst has to look that way. A message raid needs the volume, a minimum number of separate members, and several of them posting identical content. That combination is what a raid looks like and what a busy server does not.

When a raid is confirmed the raiders get the punishment you chose and the server can lock itself down: the categories you listed are closed (or the whole server if you listed none), the roles you listed are blocked, and a message explains why. The lockdown lifts on a timer, or waits for you. Lifting restores every channel to the exact permissions it had beforehand.

Members holding a whitelisted role, and anyone with Manage Messages or Manage Server, are never treated as raiders and never feed the counters.

Setup#

  1. Open the dashboard and go to Moderation > Anti-Raid, then turn the module on.
  2. Set your Detection Thresholds. Compare them against a normal busy hour in your server, not against a raid.
  3. Choose the Punishment for raiders: kick, ban, or alert only.
  4. Add your staff roles under Whitelisted Roles.
  5. Pick an Alert Channel so a detection reaches you.
  6. Under Lockdown, list the categories to close and the roles to block, write the message, and set the auto lift.

Settings#

SettingTypeDefaultWhat it does
Enable Anti-RaidToggleOffThe master switch for detection and lockdown.
Join thresholdNumber8Joins inside the join timeframe before a raid is considered.
Join timeframe (seconds)Number10How long joins are counted over.
Count accounts younger than (days)Number7Only joins from accounts under this age, or still on a default avatar, count towards a raid.
Share of the burst that must be new (%)Number60How much of the join burst has to look throwaway before it counts as a raid.
Message thresholdNumber40Messages inside the message timeframe before a raid is considered.
Message timeframe (seconds)Number10How long messages are counted over.
Distinct members requiredNumber8Separate members that must be posting in the window. One fast talker is never a raid.
Members posting identical textNumber5How many of those members must post the same content. This is what separates a raid from a lively chat.
Re-trigger cooldown (seconds)Number900Minimum gap between two detections, so one raid does not fire repeatedly.
Auto lockdownToggleOnLock the server automatically on detection instead of only alerting.
Punishment for raidersChoiceKickKick, ban, or none for alert only.
Whitelisted RolesRolesNoneMembers holding any of these are never treated as raiders.
Alert ChannelChannelNoneWhere detections are posted. Leave empty to disable alerts.
Locked categoriesChannelsNoneThe categories closed during a lockdown.
Lockdown rolesRolesNoneRequired. The roles that lose the ability to talk while locked down, and the roles /lock closes a single channel for. Most servers pick their member role; pick @everyone if members talk through @everyone. Nothing locks until at least one role is set.
Lockdown messageTextThis server is currently under lockdown for security reasons.Posted in the locked channels so members know what happened.
Lockdown log channelChannelNoneWhere lockdowns are recorded.
Auto lift after (minutes, 0 = manual)Number0How long a lockdown lasts. 0 waits for you to lift it.
Post the lockdown messageToggleOnSend the lockdown message in every locked channel.
Delete the message when unlockedToggleOnRemove those messages again once the lockdown ends, so nothing is left behind.

Commands#

Configuration moved to the dashboard, so the slash setup menu is retired. Status and the prefix fallback remain.

CommandWhat it doesRequires
.antiraid helpJoin and message rate limits, punishments and lockdowns from chat.Manage Server
/lockdown [reason]Lock the server down by hand.Administrator
/unlockdown [reason]End the lockdown and restore every channel to the permissions it had before.Administrator

Permissions#

PermissionWhy Iris needs it
Kick MembersRemoves raiders when the punishment is kick.
Ban MembersRemoves raiders when the punishment is ban.
Manage ChannelsCloses and reopens the categories during a lockdown.
Manage RolesBlocks the roles you listed while locked down.
View ChannelsSees the alert and log channels.
Send MessagesPosts the alert and the lockdown notice.

What it looks like#

I
Iris APP Today at 8:53 PM

Raid detected. Lockdown started.

Trigger

Join rate

Measured

24 joins in 60s

Action

Kicked 24 accounts

I
Iris APP Today at 8:53 PM

This server is currently under lockdown for security reasons.

Lifting automatically in 15 minutes
A detection alert, and the notice posted in the locked channels.

Tips and gotchas#

The lockdown will not lift.

Auto lift is set to 0, which means manual. Run /unlockdown to lift it, or set a number of minutes.

Do channels come back exactly as they were?

Yes. Every locked channel’s overwrites are snapshotted before the lockdown and written back verbatim when it lifts, including roles that had no overwrite at all. The snapshot is stored on disk, so it survives a restart mid-lockdown.

It triggered for no reason.

Check /antiraid status: it prints the exact conditions in force. Every one of them has to be met at once, so raise the join threshold, the account age or the new-account share until the triggers match your server.

Real members got kicked.

They joined inside the window on accounts younger than your account age setting, and hold no whitelisted role. Raise the join threshold or the account age, and whitelist any role your regulars hold.

Nothing was locked.

Iris needs Manage Permissions in the channels it is closing. With no categories listed under Lockdown the whole server is locked, so a lockdown that did nothing is almost always a permissions problem.

Does it catch a slow raid?

Not by rate alone. Ten accounts an hour is under any sensible threshold, which is what verification and the alt detection are for.