UNITEDUnited receives Discord gateway events for messages, members, channels, roles, webhooks, bans, permissions, and other enabled systems.
System walkthrough
How United Works
United separates detection, attribution, enforcement, and recovery. That separation matters because a useful security record should explain what happened and what the bot actually accomplished, not simply announce that something looked suspicious.
Written and reviewed by Reno · August 27, 2026
For structural changes, United checks Discord's audit log near the event instead of assuming the person who was recently active caused it.
The server's settings decide whether United logs, deletes, times out, strips permissions, kicks, bans, or leaves the decision to staff.
Bot Logs records the outcome. Incident tools compare known structure and offer focused repair when a saved channel, role, or permission is actually missing.
One ordered message pipeline
Message-based systems share one ordered processing path. Scam Trap checks its clearly marked decoy channel. Anti-Spam evaluates speed, duplicate text, mentions, and other configured limits. Link Limit counts repeated Discord invitations. Link filtering, sticky messages, leveling, and command handling then receive the same event in a defined order. A handled event can stop later checks when continuing would produce duplicate deletion, duplicate punishment, or contradictory replies.
This design is different from running several unrelated moderation bots. Separate bots can each see the same message and apply their own punishment without knowing what another bot already did. United's shared path gives one service enough context to avoid racing against itself and to produce one understandable result.
Audit attribution before punishment
A channel deletion event tells United which channel disappeared, but the gateway event alone may not identify who deleted it. United checks Discord's audit log for a matching action within a bounded time window. Audit entries can arrive slightly after gateway events, so the lookup allows for that delay. When Discord does not provide a reliable match, United can record an unknown actor without punishing a guessed person.
Attribution also depends on the View Audit Log permission. Enforcement depends on separate permissions and Discord role hierarchy. A bot with Administrator still cannot manage a target whose highest role is equal to or above the bot's highest role. United checks those boundaries before attempting an action and records failures that owners can correct.
Configuration decides the response
| Signal | Possible United response | Important limit |
|---|---|---|
| Fast or repeated messages | Delete, warn, timeout, or log | Ignored channels and roles must remain narrow |
| Mass or suspicious joins | Log, kick, or apply the configured raid response | Account age alone does not prove malicious intent |
| Destructive server change | Log, strip dangerous permissions, kick, or ban | A reliable audit actor and sufficient hierarchy are required |
| Scam Trap message | Immediate configured response | The channel must be clearly marked and excluded from normal use |
| Ticket inactivity | Warn or close after the saved timeout | A transcript should be delivered before destructive closure |
The server owner and United's permanent owner are protected accounts. Other administrators can be evaluated by configured protection unless they are explicitly whitelisted. A whitelist is a security exception, so owners should review it after staff and integration changes.
One log stream before specialized routes
Bot Logs is the default operational record. A new server can send moderation, protection, member, configuration, and ticket activity there while the owner validates permissions. Dedicated routes are optional for teams that need separation, such as a private transcript channel or an Anti-Nuke channel watched by senior staff. Removing an override sends that event group back to Bot Logs.
United deduplicates related records so a command response, a gateway event, and an audit-log event do not become three nearly identical moderation reports. The saved record still distinguishes the target, actor, action source, reason, duration, and Discord result where that information is available.
Recovery is comparison, not automatic destruction
Server snapshots record selected structure and permissions so Incident Mode can compare the current server with a known state. A difference is evidence to review, not proof that the current state is wrong. Restore focuses on recreating genuinely missing items and repairing altered overwrites. It should not delete unrelated channels or roles that were added after the snapshot.
Some incidents still require manual judgment. Discord may not provide an audit actor, a role can be above United, another integration may continually rewrite permissions, or the intended server structure may have legitimately changed. In those cases, logs and comparisons help staff understand the event without pretending automation can make the final decision.
What owners can verify
- Permission Health shows whether the selected features have the Discord permissions they need.
- Bot Logs shows the event, attributed actor, attempted response, and outcome.
- Ticket Health checks saved types, categories, panels, logs, and transcript destinations before repair.
- Dashboard action history can record who changed a United setting and which server was affected.
- The public documentation and command reference describe the same systems used by the running bot.