Configure detection
pup observes Discord audit-log events for bans, kicks, channel and role deletion, dangerous role-permission grants, webhook creation, and server identity changes. Choose the protected resources, detection window, thresholds and trusted actors. An empty protected-resource list covers all resources. Each incident shows the related Discord event, event count, containment result and recovery progress. After the threshold is reached, pup removes roles it can manage from the suspected actor. It never acts on the guild owner, exempt actors, managed roles, or roles at or above pup’s own hierarchy. When hierarchy prevents containment, the incident stays open for review. The same Administrative anti-nuke page includes incident review. A security approver other than the suspected actor can mark a false positive, begin recovery, and complete recovery. Recovery does not recreate deleted resources or restore permissions automatically.Emergency containment
Open Protection overview → Emergency containment to restrict a Discord resource during an incident. Choose its name, a duration, and an optional reason, then confirm the action. The dashboard handles one resource at a time; choose another resource separately if needed. pup checks ownership and role hierarchy before changing Discord. It can suspend permissions on a pup-owned containment role below the bot, apply six-hour slowmode to a channel, deny that channel’s@everyone message sending, or remove invite creation from the server’s @everyone
role. Managed bot roles and roles pup does not own cannot be suspended.
Choose Restore access to restore the original permissions. pup preserves manual changes
made after containment. The incident shows whether Discord has confirmed the change.
Deleting a compromised webhook is permanent. The confirmation dialog explains that it cannot
be restored. pup checks that the webhook belongs to the server and never stores its URL or token.