• Web Application Firewall

waf
  1. Help Center
  2. Web Application Firewall
  3. API Reference
  4. APIs
  5. Event Logs
  6. Querying Event Logs

Querying Event Logs

Function Description

This API is used to query attack event logs.

URI

  • URI format

    GET /v1/{project_id}/waf/event?from={from}&to={to}&hosts={hostname}&attacks={attack}&sips={sip}&offset={offset}&limit={limit}

  • Parameter description
    Table 1 Path parameters

    Parameter

    Mandatory

    Type

    Description

    project_id

    Yes

    String

    Specifies the project ID.

    from

    Yes

    Long

    Specifies the start time (UTC) in milliseconds. For example, 1548172800000.

    to

    Yes

    Long

    Specifies the end time (UTC) in milliseconds. For example, 1548431999000.

    hosts

    No

    Array

    Specifies the domain IDs.

    attacks

    No

    Array

    Specifies the list of attack types. For example, sqli and xss.

    sips

    No

    Array

    Specifies the attack source IP addresses. For example, 192.168.12.23 and 192.168.20.85.

    nsips

    No

    Array

    Specifies the excluded attack source IP addresses. For example, 192.168.12.1 and 192.168.20.2.

    offset

    No

    Long

    Specifies the number of returned pages. Its value ranges from 0 to 65535. The default value is 0.

    limit

    No

    Long

    Specifies the maximum number of records displayed on each page. Its value ranges from 0 to 50. The default value is 10.

    marker

    No

    String

    Specifies the ID of the last event record on the previous page.

Request

Request parameters

None

Response

Response parameters
Table 2 Parameter description

Parameter

Type

Description

total

Integer

Specifies the total number of event logs.

items

Table 3

Specifies the event log objects.

Table 3 items

Parameter

Type

Description

id

String

Specifies the event ID.

time

Integer

Specifies the attack time since Unix Epoch in milliseconds.

policyid

String

Specifies the policy ID.

sip

String

Specifies the attack source IP address.

host

String

Specifies the attacked domain name or IP address.

url

String

Specifies the attacked URL, excluding a domain name.

attack

String

Specifies the attack type.

  • cc refers to CC attack.
  • cmdi refers to command injection.
  • custom_custom refers to Precise Protection events.
  • illegal refers to invalid requests.
  • sqli refers to SQL injection.
  • lfi refers to local file inclusion.
  • robot refers to malicious crawlers.
  • antitamper refers to Web Tamper Protection events.
  • rfi refers to remote file inclusion.
  • vuln refers to other types of attacks.
  • xss refers to XSS attack.
  • custom_whiteblackip refers to Blacklist and Whitelist events.
  • webshell refers to webshells.

rule

String

Specifies the matched rule ID that consists of six digits.

payload

String

Specifies the hit load.

action

String

Specifies the protective action.

  • Block: WAF blocks and logs detected attacks.
  • Log only: WAF logs detected attacks only.
  • Allow: WAF allows the requests that meet the specified conditions.
  • Verification code: A verification code is displayed when the number of requests reaches the maximum limit in a CC attack protection rule. Upon completing the verification, you are no longer restricted by the maximum number of requests allowed.
  • Filter: WAF implements data masking.
  • Mismatch: The cached webpage in the WAF engine does not match the original webpage.

payload_location

String

Specifies the location in the request packet where the attack occurs. The options are as follows: body, url, params, and header.

request_line

String

Specifies the attack request method.

headers

Object

Specifies the attack request header.

cookie

String

Specifies the cookie.

body

String

Specifies the body of an attack request.

Example

total with a value of 2 is used as an example.

Response example
{
  "total": 2,
  "items": [
    {
      "id": "0000-0000-0000-13-56ef71f5745764348192f844658dd144",
      "time": 1499817600,
      "policyid": "xxx",
      "sip": "192.168.1.1",
      "host": "a.com",
      "url": "/login",
      "attack": "sqli",
      "rule": "20001",
      "payload": "1 or 1=1",
      "action": "block",
      "payload_location": "params",
      "request_line": "GET / ",
      "headers": {
        "Connection": "keep-alive",
        "User-Agent": "curl"
      },
      "cookie": "sid=123; uid=456",
      "body": "user=admin&pass=abc123"
    },
   {
      "id": "0000-0000-0000-13-56ef71f5745764348192f844658dd144",
      "time": 1499817600,
      "host": "a.com",
      "policyid": "xxx",
      "sip": "192.168.1.2",
      "url": "/login",
      "attack": "sqli",
      "rule": "20001",
      "payload": "1 or 1=1",
      "action": "log",
      "payload_location": "params",
      "request_line": "GET / ",
      "headers": {
        "Connection": "keep-alive",
        "User-Agent": "curl"
      },
      "cookie": "sid=123; uid=456",
      "body": "user=admin&pass=abc123"
    }
  ]
}

Status Code

Table 4 describes the normal status code returned by the API.
Table 4 Status code

Status Code

Description

Meaning

200

OK

The request has succeeded.

For details about error status codes, see Status Codes.