Anti-nuke
Detects and stops mass destructive actions inside your server.
"Nuking" a server means destroying it quickly: deleting every channel, banning the members, or removing all the roles. It usually follows an administrator account being compromised, or a trusted member turning on the server.
Anti-nuke detects this and stops it.
How it works
Discord keeps an audit log, a record of who performed each action in a server. TalciGrade reads it as actions happen.
When one member performs too many destructive actions too quickly, TalciGrade responds. For example, deleting three channels within ten seconds.
The default settings that it comes with
| Action | Threshold | Response |
|---|---|---|
| Deleting channels | 3 in 10 seconds | Quarantine |
| Creating channels | 5 in 10 seconds | Quarantine |
| Deleting roles | 3 in 10 seconds | Quarantine |
| Creating roles | 5 in 10 seconds | Quarantine |
| Banning members | 5 in 15 seconds | Quarantine |
| Kicking members | 5 in 15 seconds | Quarantine |
| Creating webhooks | 5 in 10 seconds | Delete them and quarantine |
| Granting a role admin powers | Once | Undo it and post an alert |
These numbers are set low enough to catch a real attack and high enough that normal admin will not set them off. You can change any of them.
Available responses
| Response | What happens |
|---|---|
| Alert | Posts a notice. Nothing else |
| Undo + alert | Undoes what they did, but nothing happens to them (Undo may not always be useful) |
| Quarantine | Removes all their roles and locks them out of every channel |
| Undo + quarantine | Both |
| Quarantine + lockdown | Quarantines them and locks every channel in the server |
| Kick or Ban | Removes them from the server |
Quarantine is the default because it can be undone. If it turns out to be a mistake, you simply unquarantine them with one command and all of their roles come back. A ban cannot be taken back so easily.
"Undo" means different things depending on the action. Deleted channels are restored, created channels are removed, and banned members are unbanned.
Deleting a channel destroys the messages in it permanently. TalciGrade can rebuild the channel, but Discord provides no way to restore deleted messages.
Preventing permission grants
If a role is edited to add a dangerous permission, TalciGrade reverses the change and posts an alert.
Dangerous permissions are Administrator, Manage Server, Manage Roles, Manage Channels, Ban Members, Kick Members, Manage Webhooks, and the ability to mention @everyone.
By default this only alerts and does not punish anyone, because admins do genuinely need to change roles sometimes. This, as well as everything else, can be modified thru the Dashboard.
Trusted members
Members, bots and roles can be marked as trusted. Trusted accounts are exempt from every check above.
This is intended for your own automation and for staff who legitimately perform actions in bulk.
Be careful with this. If a trusted account gets hacked, nothing here will stop it. That is why nothing is trusted at the start except you and people with all permissions.
Setting it up
Open Security > Anti-Nuke on the Dashboard to change any threshold or response, and Security > Whitelist to manage trusted members and roles.