Threat Analysis (Threats Dashboard)

The Threats dashboard provides an avenue through which a historical analysis of recent threats to site traffic may be performed. This type of an analysis provides the means through which you may:

Log data is retained for 30 days for most WAF solutions. The exception is WAF Insights which only retains data for 7 days.

This article describes how to use:

Usage

The dashboard contains two different views through which threat analysis may be performed, which are:

To view the Threats dashboard

  1. Navigate to the Threats dashboard (Threats tab of the Overview page). ClosedHow?From the main menu, navigate to MoreSecurity | WAF Tier | Dashboard.

    The dashboard will display a chart showing recent violations of your security policy.

  2. Optional. View event log data by clicking Event Logs from the side navigation bar.

Overview

Use the Overview to detect patterns for objectionable traffic directed at your applications and web servers. This view consists of two basic components:

Component Description

Chart

A chart or line graph displays the number of threats detected over a given time period.

By default, a single line on the graph represents all threats. Alternatively, categorize threats by selecting the desired categorization criteria from the option that appears directly above the graph. A line will be drawn on the chart for each unique value. For example, if you select Profile Type and requests were screened by production and audit rules, then the graph will contain a line for audit and another one for production.

By default, graphing threats by type will include up to the 10 most popular entries. Customize this limit through the Max Top Number option. This option also affects the maximum number of unique entries that may be listed for each type of statistic listed under the graph.

Statistics

Statistics on the threats detected over a given time period are displayed directly below the chart. Statistics are broken down by category.

View category definitions.

By default, statistics for up to the 10 most popular entries may be displayed for each category. Customize this limit through the Max Top Number option. This option also affects the maximum number of lines that may be graphed.

The following information is displayed for each category:

Percentages are calculated from the total threats detected during the given time period. The Max Top Number option determines the limit of entries per category. If the number of entries exceeds this limit, then the sum of the percentages for that category will not add up to 100%.

Key information:

Event Log View

This view provides the means to delve into the details of an illegitimate request. The information derived from this view provides a deeper understanding as to why a request was deemed objectionable and the type of attacks being mounted on an origin server.

The event log contains a list of recent rule violations. The header bar for each violation uses the syntax described below.

Syntax:

Example:

Access rule for Marketing site 10s ago 15:01:23.45 UTC

Field Definitions

Clicking on an event (i.e., rule violation) expands that entry to show detailed information about it. Each event field is described below.

Field Description

Timestamp

Indicates the date and time (UTC) at which the rule violation occurred.

Format: YYYY-MM-DD hh:mm:ss.millisecondsIdentifies a date and time (UTC/GMT) using a 24 hour format (e.g., 2022-07-08 15:00:22.123).

Managed Rules Name

Indicates the name of the managed rule set that was violated. If a managed rule was not violated, then this field will be empty.

Rule Message

Provides a description of the rule that the request violated. The syntax for this field varies according to the type of rule that was violated.

Event ID

Indicates the system-defined ID assigned to this event (i.e., rule violation).

Security Application Name

Indicates the name of the Security Application Manager configuration that was assigned the rule set that was triggered.

Profile Type

Indicates whether the request was screened as a result of a production or audit rule.

Country Name

Identifies the country from which the request originated by its name.

Action Type

Indicates the type of action that was taken in response to the rule violation. Valid values are:

  • BLOCK_REQUEST: Indicates that the request that violated a rule was blocked.
  • ALERT: Indicates that an alert was generated in response to the rule violation.
  • REDIRECT_302: Indicates that the request that violated a rule was redirected to the URL associated with the instance defined by the Instance Name field.
  • CUSTOM_RESPONSE: Indicates that a custom response was returned to the client that submitted a request that violated a rule.

Client IP

Identifies the IP address of the client from which the request originated.

URL

Indicates the URL of the request that triggered the rule violation.

Referer

Indicates the request’s referrer as defined by the Referer request header.

User Agent

Indicates the user agent that submitted the request that triggered the rule violation. This information is derived from the User-Agent request header.

Sub Events

In addition to the core set of fields described above, a sub event for each rule that was violated by the request will be reported. The syntax for the header bar associated with each sub event is described below.

Rule ID: Rule ID

Rule Message: Rule Message

Each sub event contains the following fields:

Field Description

Matched On

Indicates a variable that identifies where the violation was found.

Matched Value

Indicates the value of the variable defined by the Matched On field.

Standard security practices dictate that measures should be taken to prevent sensitive data (e.g., credit card information or passwords) from being passed as clear text from the client to your origin server. Another incentive for encrypting sensitive data is that it will be logged by our system when an alert is triggered as a result of this data. If sensitive data cannot be encrypted or obfuscated, then it is strongly recommended to contact our technical customer support to disable logging for the Matched Value field.

Rule ID

Indicates the ID for the rule that the request violated.

Rule Message

Provides a description of the rule that the request violated.

Operator Name

Indicates how the system interpreted the comparison between the Operator Parameter and the Matched Value fields. Common operators are:

  • BEGINSWITH: Begins with. Identifies a match due to a request element that started with the specified match value.
  • CONTAINS: Contains. Identifies a match due to a request element that contained the specified match value.
  • ENDSWITH: Ends with. Identifies a match due to a request element that ended with the specified match value.
  • STREQ: Exact match. Identifies a match due to a request element that was an exact match to the specified match value.
  • RX: Regex. Identifies a match due to a request element that satisfied the regular expression defined in the match value.
  • EQ: Value match. Identifies a match due to a request element that occurred the exact number of times defined in your custom rule.
  • IPMATCH: IP Address. Identifies a match due to the request's IP address either being contained within an IP block or that was an exact match to an IP address defined in your custom rule.

Operator Parameter

Indicates the source or the value that was compared against the Matched Value field.

Rule Tags

Indicates the tags associated with the rule that the request violated. These tags may be used to determine whether a rule, access control, or global setting was violated.

Naming convention:

Total Anomaly Score

Indicates the anomaly score assigned to the request. This score is determined by the number of rules that were violated and their severity.

Filters

Filters are applied to both the Overview and the Event Log views. Most fields support filtering.

The Overview and the Event Log views cannot be filtered by the Timestamp field. Use the Time Range option instead. This option filters the dashboard for events that occurred during a relative time period from the present (e.g., Last 24 hours or Last 7 days).

Key information: