• Web Application Firewall

waf
  1. Help Center
  2. Web Application Firewall
  3. API Reference
  4. APIs
  5. Event Logs
  6. Querying Event Logs by ID

Querying Event Logs by ID

Function Description

This API is used to query event logs by ID.

URI

  • URI format

    GET /v1/{project_id}/waf/event/{event_id}

  • Parameter description
    Table 1 Path parameters

    Parameter

    Mandatory

    Type

    Description

    project_id

    Yes

    String

    Specifies the project ID.

    event_id

    Yes

    String

    Specifies the event ID.

Request

Request parameters

None

Response

Response parameters
Table 2 Parameter description

Parameter

Type

Description

id

String

Specifies the event ID.

time

Integer

Specifies the attack time since Unix Epoch in milliseconds.

policyid

String

Specifies the policy ID.

sip

String

Specifies the attack source IP address.

host

String

Specifies the attacked domain name or IP address.

url

String

Specifies the attacked URL, excluding a domain name.

attack

String

Specifies the attack type.

rule

String

Specifies the ID of the matched rule.

payload

String

Specifies the hit load.

action

String

Specifies the protective action.

  • Block: WAF blocks and logs detected attacks.
  • Log only: WAF logs detected attacks only.
  • Allow: WAF allows the requests that meet the specified conditions.
  • Verification code: A verification code is displayed when the number of requests reaches the maximum limit in a CC attack protection rule. Upon completing the verification, you are no longer restricted by the maximum number of requests allowed.
  • Filter: WAF implements data masking.
  • Mismatch: The cached webpage in the WAF engine does not match the original webpage.

payload_location

String

Specifies the location in the request packet where the attack occurs. The options are as follows: body, url, params, and header.

request_line

String

Specifies the attack request method.

headers

Object

Specifies the attack request header.

cookie

String

Specifies the cookie.

body

String

Specifies the body of an attack request.

Example

Event ID 0000-0000-0000-13-56ef71f5745764348192f844658dd144 is used as an example.

Response example
{
     "id": "0000-0000-0000-13-56ef71f5745764348192f844658dd144",
      "time": 1499817600,
      "policyid": "xxx",
      "sip": "192.168.1.1",
      "host": "a.com",
      "url": "/login",
      "attack": "sqli",
      "rule": "20001",
      "payload": "1 or 1=1",
      "action": "block",
      "payload_location": "params",
      "request_line": "GET / ",
      "headers": {
        "Connection": "keep-alive",
        "User-Agent": "curl"
      },
      "cookie": "sid=123; uid=456",
      "body": "user=admin&pass=abc123"
    }

Status Code

Table 3 describes the normal status code returned by the API.
Table 3 Status code

Status Code

Description

Meaning

200

OK

The request has succeeded.

For details about error status codes, see Status Codes.