Raid Defense
Kicks accounts that are too new to be trusted, and detects a join-rate spike to trigger a lockdown, mass-kick, or mass-timeout of everyone who just joined.
Overview
Two independent triggers run on every member join.
New-Account Filter
If Minimum Account Age is set (days, 0 = off), any account younger than that is kicked immediately — this always kicks, regardless of whatever "Action on Raid" is configured below. A "👶 New Account Kicked" entry logs the member and their account age — that's the only log entry it produces, the generic member-kicked log is skipped for it so the same departure isn't logged twice. It also doesn't trigger a Leave message (see Welcome & Leave). Members kicked this way don't count toward the join-spike tracker.
Join-Spike Detection
Aegis tracks every join in a rolling window. If the number of joins within Join Window seconds (default 30, range 5–120) reaches Join Threshold (default 10, range 3–100), it fires once — the log resets afterward so it won't re-trigger on every subsequent join of the same wave.
On trigger, Aegis pings the server owner directly with a "🚨 Raid Detected" alert, then runs Action on Raid:
| Action | What happens |
|---|---|
| Lockdown (default) | Removes Send Messages from @everyone on every text/announcement channel. Stays locked until manually ended. |
| Kick | Kicks every non-bot member who joined within the last Join Window seconds. |
| Timeout | Times out (fixed 10 minutes, not configurable) every non-bot member who joined within the last Join Window seconds. |
There's no automatic "raid over" expiry. Lockdown mode stays active until a moderator manually ends it — from the dashboard's Raid Defense panel (Start/End Lockdown button) or the same manual control.
Settings Summary
| Setting | Default |
|---|---|
| Minimum Account Age | 0 days (off) |
| Join Threshold | 10 joins |
| Join Window | 30 seconds |
| Action on Raid | Lockdown |
Logging
Raid alerts and new-account kicks post to the Raid Defense event on the Logging page. The lockdown start/end itself is also captured under the "Channels" event, since it's implemented as a bulk permission-overwrite change.