AtomicShield Guide

AtomicShield is AtomicBot’s behavioral Discord security system.

It detects things like:

• Message floods
• Cross-channel spam
• Duplicate and near-duplicate campaigns
• Mention spam
• URL spam
• Bot floods
• Webhook floods
• Repeat offenders
• Suspicious activity from new accounts

AtomicShield only uses Discord-side telemetry available to the bot.

Opening AtomicShield

Go to:
Security → AtomicShield

The console includes:

• Overview
• Settings
• Detection & Scoring
• Trusted Actors
• Incidents
• Audit Log
• Retention

Overview

The Overview tab shows recent AtomicShield activity, including:

• Incidents in the last 24 hours
• Incidents in the last 7 days
• Contained incidents
• Messages removed
• User, bot, and webhook incidents
• Average and highest threat score
• Trusted actors
• Recent cases

Click a case number to open the full incident review.

Settings

AtomicShield Enabled

Turns AtomicShield on or off for the Discord guild.

Operating Mode

AtomicShield supports two modes:
OBSERVE
Detects and records suspicious behavior without automatically punishing the actor.

ENFORCE
Allows AtomicShield to automatically respond to detected threats.

For first-time setup, use OBSERVE.

Minimum Threat Score

AtomicShield combines multiple behavior signals into a threat score.

Default:
50

Higher values make AtomicShield less sensitive.
Lower values make it more aggressive.

Security Log Channel

Enter the Discord channel ID where AtomicShield should send private incident reports.

AtomicBot should have permission to:

• View Channel
• Send Messages
• Embed Links

Automatic Containment

When AtomicShield is in ENFORCE mode, it can:

• Delete flood messages
• Timeout users
• Ban malicious bots
• Delete malicious webhooks

You can enable or disable each action separately.
Protected staff are never automatically punished.

Public Containment Notice

AtomicShield can optionally post a public message after containing malicious activity.

Available styles:
MINIMAL

• Short containment message

DETAILED

• Actor
• Source type
• Case number
• Confirmation that evidence was preserved

You can also choose whether the actor and case number are included.

Detection & Scoring

The Detection & Scoring tab controls how AtomicShield identifies suspicious behavior.

Changes autosave.

Message Flood Detection

AtomicShield uses several message-volume thresholds.

Default values:
| Detection | Threshold | Score |
|---|---:|---:|
| Short Burst | 5 messages | +25 |
| Medium Burst | 8 messages | +15 |
| Extreme Burst | 12 messages | +15 |
| Severe Flood | 20 messages | +20 |

These scores can stack.

Cross-Channel Floods

Default:

• 3 channels
• 6 messages
• +15 threat score

This helps detect users or bots rapidly spreading spam across multiple channels.

Duplicate Messages

AtomicShield normalizes message content before comparing it.

Default duplicate detection:

• 5 messages
• 60% duplicate ratio
• +15 threat score

Severe duplicate detection:

• 8 messages
• 85% duplicate ratio
• +10 additional threat score

Near-Duplicate Detection

AtomicShield can also detect messages that are very similar but not completely identical.

Default similarity threshold:
85%

This helps detect spam where the attacker slightly changes each message.

Mention Spam

Default:
| Detection | Threshold | Score |
|---|---:|---:|
| Mention Spam | 6 mentions | +10 |
| Mass Mentions | 12 mentions | +10 |

URL Spam

Default:

• 5 URLs
• +10 threat score

AtomicShield tracks both:

• Total URLs
• Unique domains

Bot and Webhook Floods

Bots and webhooks can be detected for machine-speed message bursts.

Default:

• 4 messages in the short detection window
• +15 threat score

Legitimate high-volume bots should be added to Trusted Actors.

New Account Risk

AtomicShield can add additional threat score when a Discord account is very new.

Default:

• Account younger than 3 days
• +10 threat score

Repeat Offenders

Previous AtomicShield incidents can increase the actor’s threat score.

Default:

• 1 previous incident → +10
• 3 previous incidents → +10 additional

Trusted Actors

Trusted Actors completely bypass AtomicShield detection.

Supported types:

• USER
• BOT
• WEBHOOK

Use this for legitimate high-volume services such as:

• Ticket bots
• Logging bots
• Moderation bots
• Server integrations
• Trusted webhooks

Each trusted actor can be enabled, disabled, or removed.

Incidents

Every AtomicShield incident receives a case number similar to:
AB-260902-A1B2C3

The Incidents tab allows you to search and filter by:

• Case number
• Actor
• Actor type
• Classification
• Review status
• OBSERVE / ENFORCE
• Minimum threat score

Incident Review

Opening an incident shows:

Actor

• Username
• Display name
• Discord ID
• Actor type
• Account creation date
• Guild join date

Detection

• Threat score
• Classification
• Detection reasons
• Message count
• Channel count
• Mentions
• URLs
• Duplicate ratio
• Peak message rate
• Previous incidents

Response

• OBSERVE or ENFORCE
• Containment success
• Messages deleted
• Action taken
• Security report status
• Public notice status

Evidence

• Message ID
• Channel
• Timestamp
• Message content
• Content hash
• Mentions
• Domains
• Attachments
• Deleted status

Incident Review Status

Moderators can mark incidents as:
OPEN

• Not reviewed yet

CONFIRMED

• Valid malicious activity

FALSE_POSITIVE

• Legitimate activity incorrectly detected

DISMISSED

• Reviewed and no further action required

Moderator notes can also be added.

Audit Log

The Audit Log records AtomicShield administration changes such as:

• Setting changes
• Detection threshold changes
• Trusted actor changes
• Incident reviews
• Retention cleanup

This provides a history of who changed what and when.

Retention

AtomicShield supports separate retention periods for evidence and incidents.

Default:

• Evidence: 90 days
• Incidents: 365 days

After evidence expires, sensitive message content can be removed while the incident record remains.

The Run Cleanup Now button applies the current retention policy immediately.

Recommended Setup

For a new Discord:

1. Enable AtomicShield.
2. Set mode to OBSERVE.
3. Configure the Security Log Channel.
4. Keep the default detection settings.
5. Add legitimate high-volume bots and webhooks to Trusted Actors.
6. Review incidents for false positives.
7. Adjust only the thresholds that need tuning.
8. Confirm AtomicBot has the required Discord permissions.
9. Switch to ENFORCE once you are comfortable with the results.

Required Discord Permissions

Depending on the enabled features, AtomicBot may need:

• View Channels
• Read Message History
• Send Messages
• Embed Links
• Manage Messages
• Moderate Members
• Ban Members
• Manage Webhooks

Role hierarchy also matters.

AtomicShield vs AtomicGuard vs HoneyPot

AtomicShield

• Behavioral protection
• Floods
• Spam campaigns
• Bots
• Webhooks
• Mentions
• URLs

AtomicGuard

• Message content moderation
• Rules
• Categories
• Strikes
• Moderation policies

HoneyPot

• Trap-based protection
• Immediate response when a protected trap channel is triggered

Using all three provides the strongest AtomicBot Discord security setup.

Quick Recommendation

For most servers:

• AtomicShield: Enabled
• Mode: OBSERVE
• Minimum Threat Score: 50
• Staff Logging: Enabled
• Public Notice: Disabled initially
• Evidence Retention: 90 days
• Incident Retention: 365 days

Once normal Discord activity has been reviewed and trusted integrations have been added, move AtomicShield to ENFORCE.