After you add a website to Web Application Firewall (WAF), you can configure alert settings. This allows WAF to send you notifications when it detects an attack event or abnormal traffic, helping you stay informed about the security of your services.
Prerequisites
You have added your website to WAF. For more information, see Add a website to WAF.
Optional: You have enabled Log Service for WAF and enabled log collection for the domain name that WAF protects. For more information, see Get started with WAF Log Service.
By default, WAF integrates with CloudMonitor to provide monitoring and alert capabilities. You can use CloudMonitor to configure monitoring and alert rules for WAF attack events and WAF metrics. If the metrics supported by CloudMonitor do not meet your requirements, you can use Log Service to create custom alerts.
You must meet this prerequisite to use Log Service to configure alerts.
Procedure
-
Log on to the Web Application Firewall console.
-
In the top menu bar, select the resource group and region for your Web Application Firewall instance (Chinese Mainland or Outside Chinese Mainland).
In the left-side navigation pane, choose .
On the Alert Settings page, choose a notification method based on the event type.
Method
Description
CloudMonitor Notification
You can create WAF alert rules by using the alerting feature of CloudMonitor.
CloudMonitor is a service for monitoring Alibaba Cloud resources and internet applications. The CloudMonitor alerting service supports monitoring events and service metrics for cloud products.
CloudMonitor Notification supports monitoring all WAF events listed on the Alert Settings page, including Web Attack Event, HTTP Flood Attack Event, ACL-based Attack, Scan Attack Event, Traffic Monitoring and Alerting, Unusual Traffic Monitoring Alert, Attack Monitoring and Alerting, Bandwidth Threshold Exceeded, and QPS Threshold Exceeded.
Click CloudMonitor Notification to go to the alert rule configuration page in the CloudMonitor console, where you can configure alert rules. For more information, see Configure CloudMonitor notifications.
Log Service Configuration
You can create WAF alert rules by using the log alerting feature of WAF Log Service.
WAF Log Service helps you collect and store request logs for domain names that WAF protects, allowing you to query and analyze the logs. From these results, you can create custom alert rules for specific metrics.
Log Service Configuration supports monitoring various combinations of metrics. This method offers greater flexibility and is ideal for customized alert scenarios, but it is also more complex.
Click Log Service Configuration to go to the WAF Log Service page. On this page, you can query and analyze WAF logs and create custom alerts. For more information about how to configure WAF log alerts, see Quickly set up log-based alerting. For configuration examples, see Overview.
View Alerts Generated During Last 30 Days
Displays alerts from the last 30 days that were triggered by exceeding WAF bandwidth or qps thresholds.
If the normal traffic of your website exceeds the service bandwidth or qps specification of your WAF instance, WAF automatically displays an alert at the top of the console (as shown in the following figure) and sends an alert by email to the contacts for your Alibaba Cloud account.
The Alert settings page allows you to view alert details from the last 30 days. You can click View Alerts Generated During Last 30 Days next to DDoS attacks occur, the peak attack bandwidth exceeds the protection threshold of Anti-DDoS Origin Basic, and blackhole filtering is triggered for the WAF instance. or QPS Threshold Exceeded to view details about service bandwidth or qps exceedance alerts (as shown in the following figure).
For more information, see bandwidth extension package.