Skip to main content
The Scam defense dashboard groups related findings into campaigns and local incidents. It gives moderators a bounded response workflow without exposing another server’s identity or evidence. Opening Scam Defense and running playbooks requires Admin or Owner dashboard access. A Discord moderator role by itself does not grant this access.

​
Campaigns and incidents

A campaign is network-wide correlation between qualified indicators. Its status can be:
  • First seen — qualified activity has started.
  • Spreading — at least three participating servers reported it, with a sighting in the last 24 hours.
  • Contained — no new sighting for 3 days.
  • Dormant — no new sighting for 14 days.
A new sighting makes a contained or dormant campaign active again. A local incident exists when a qualified campaign indicator matches your server’s own AutoMod history. It shows:
  • Indicator type, without the raw shared indicator
  • Severity and status
  • Number of local matches
  • Distinct affected accounts and channels
  • Recent local event timeline
  • Notification and retro-hunt status
Incident status is Open, Investigating, Contained, or Dismissed.
A campaign can be active without creating an incident for your server. Your dashboard shows an incident only when tenant-isolated local events match.

​
Automatic incident handling

When a confirmed network indicator matches recent local history, Thea can:
  1. Create or update the local incident.
  2. Alert the configured AutoMod log channel.
  3. Start a bounded retro-hunt for eligible messages that were previously logged.
  4. Activate temporary hardening if you enabled it.
The retro-hunt looks back no more than seven days and considers at most 50 linked events per pass. It fetches a still-live Discord message, derives the indicator again, and deletes the message only when it still matches the current confirmed verdict. Retro-hunt never times out, kicks, or bans a member. It logs a completion notice when it deletes one or more messages. It skips:
  • events a moderator approved;
  • messages from staff, bots, and webhooks;
  • messages Thea only logged because automated enforcement was paused or your server was outside the staged rollout. These stay skipped after enforcement turns on.
If Discord is temporarily unavailable, Thea retries the retro-hunt with a backoff for up to 24 hours after the incident opened. If Thea lacks a permission it needs, the incident shows Retro-hunt: Failed. During the network’s observe-only rollout, incidents still appear on the dashboard and your moderator playbooks still work. Thea does not post incident alerts, run retro-hunts, or activate adaptive hardening until the rollout ends. It then alerts only for incidents that are still matching, not for everything recorded during the rollout.

​
Moderator playbooks

Open an Open or Investigating incident to see its actions.

​
Contain now

Contain now starts a background response job. It can:
  • Delete up to 50 linked, still-actionable messages.
  • Apply a one-hour timeout to up to 10 affected members.
  • Treat an already-deleted message or a member who already left as resolved.
Thea rechecks each event immediately before the Discord action. If a moderator approved it, resolved the incident, or otherwise made it ineligible, the worker skips it. Containment never acts on messages from staff, bots, or webhooks. It never times out a member with Administrator, Manage Server, Manage Messages, or Moderate Members. If a member’s existing timeout already lasts at least the containment hour, Thea leaves it unchanged, so it never shortens a longer timeout your staff set. When Thea retries a job, it skips members an earlier attempt already handled. A member you release stays released. The playbook never bans a member and never searches unrelated server history. When every actionable target is resolved, Thea marks the incident Contained automatically.
Contain now performs Discord actions. Review the incident timeline first and confirm Thea has Manage Messages and Moderate Members.

​
Warn exposed channels

Warn exposed channels posts a security notice to up to five distinct affected channels. The notice tells members who opened a link or downloaded a file to change the affected password, enable multi-factor authentication, and review active sessions. The action deduplicates channels. You can run it once per incident. If the warning fails or is cancelled, you can run it again.

​
Resolve contained

Use Resolve contained when the required response has already happened or no further playbook action is needed. This changes incident state; it does not delete messages or time out members by itself. While Contain now is queued, Resolve contained is unavailable, because containment marks the incident Contained itself when it finishes. Use False positive if you need to cancel queued containment. Neither resolution is available while a playbook is running. Resolving an incident cancels a queued exposure warning that has not been posted yet. The incident card says when a playbook is queued or running.

​
False positive

Use False positive only when the underlying detection was wrong. This resolution:
  • Dismisses the local incident.
  • Marks its linked network evidence as approved and cancels remaining retro-hunt or playbook work for that incident.
  • Labels eligible shadow-learning features as negative.
  • Recomputes the shared verdict so independent human corrections can suppress or retract it.
One server’s decision cannot suppress a network verdict by itself. Marking an incident false positive also cannot restore a message that Discord already deleted.

​
Failed and partial actions

Response jobs record how many messages were deleted, members were timed out, and notices were posted.
  • Temporary Discord or rate-limit failures are retried.
  • Missing permissions or invalid Discord targets stop unsafe repeated attempts; the incident stays open instead of reporting success.
  • A resolved or no-longer-actionable incident cancels pending work.
  • Two workers cannot claim the same job at once.
If a playbook does not finish, correct the listed Discord permission or target problem before trying again. Do not mark the incident contained merely to hide an incomplete response.

​
Review safety

Human review always takes priority over queued automation:
  • Approve means the finding was a false positive; Uphold confirms the detection.
  • An approved finding is excluded from new retro-hunt and response targets.
  • The worker reauthorizes the event immediately before every delete, timeout, or notice.
  • Network consumption must still be enabled when network-owned background work is claimed.
  • A false-positive correction contributes only through the privacy-preserving verdict process.

​
Permissions