View security reports for web security bot management and access control - Web Application Firewall - Alibaba Cloud - Web Application Firewall

The Web Application Firewall (WAF) security report provides protection records from each WAF module. You can use the security report to review protection records from the Web Security, Bot Management, and Access Control/Throttling modules for domains added to WAF to gain insights for business security analysis.

Prerequisites

Your website has been added to WAF. For more information, see Tutorials.
WAF protection is enabled.
After you add a domain to WAF, the Protection Rules Engine and HTTP Flood Protection modules are enabled by default. You must manually enable other modules. For more information, see Overview.

Security reports

WAF instances use different control planes based on their region. WAF instances in the Chinese mainland are managed by the control plane in the China (Hangzhou) region. WAF instances outside the Chinese mainland are managed by the control plane in the Singapore region.

The security report page provides a centralized view of protection statistics and log information for all your protected resources. The charts and data displayed are based on the control plane that corresponds to the region of your WAF instance.

Log on to the Web Application Firewall (WAF) console. In the top menu bar, select the resource group and region for your WAF instance: Chinese Mainland or Outside Chinese Mainland.
In the left navigation pane, choose Security Operations > Security Reports.
On the Security Reports page, select a tab to view the corresponding report: Web Security, Bot Management, or Access Control/Throttling.
For more information about each report, see the following sections:

Web security report

The Web Security report displays protection records from the Web Intrusion Prevention, Data Leakage Prevention, Account Security, and Positive Security Model modules. You can click a tab to switch between reports.

Web Intrusion Prevention: Displays all web application attacks that are blocked by WAF. This report contains two sections: attack analysis charts at the top and attack event records at the bottom.
- The attack analysis charts include Attack Type Distribution, Top 5 Attack IP Addresses, and Top 5 Attack Regions.
  Above the charts, you can specify a domain and a time range to filter the data.
- The attack event records provide detailed information about web attacks, including Attacker IP Address, Region, Attack Time, Attack Type, Attack URL, Request Method, Request Parameter, Action, Rule ID, and Attack Probability.
  Above the attack event record table, you can filter records using fields such as Protection Module, Attack Type, Attack IP, Rule ID, and Rule Action.
  You can perform the following operations on attack event records:
  - Click View Details in the Actions column of an attack event record to view the Attack Details.
  - If you determine that a blocked request is a false positive and want to prevent WAF from blocking similar requests, click Ignore False Positives in the Actions column.
    WAF then bypasses the corresponding system rule checks for similar requests. In the Create Rule dialog box that appears, set a Rule Name for the auto-generated rule and click Save.
    Note
    In rare cases, a request might be blocked because it triggers multiple protection rules. A whitelist rule generated by the Ignore False Positives operation bypasses only one of the triggered protection rules. In this situation, you can manually modify the IDs of Specific Rules parameter in the whitelist rule to add the IDs of the other rules that you want to bypass.
    After the rule is created, it is automatically enabled. You can query, edit, and delete existing rules on the Web Intrusion Prevention - Whitelist page. For more information, see Configure a whitelist for web intrusion prevention.
For more information about how to configure Web Intrusion Prevention, see Configure the Protection Rules Engine.
Data Leakage Prevention: Displays records of web requests that trigger Data Leakage Prevention rules. The records include Attacker IP Address, Region, Attack Time, Attack URL, Request Method, Request Parameter, Action, Rule ID, and Attack Probability. You can specify a domain and a time range to filter the data.
Click View Details in the Actions column of a record to view the Attack Details.
For more information about how to configure Data Leakage Prevention, see Configure data leakage prevention.
Account Security: Displays risk event records for protected endpoints configured in Account Security. The information includes Domain Name, Endpoint, Time Frame of Malicious Requests, Blocked Requests/Total, and Alert Cause. You can filter records by domain, endpoint, and time range.
For more information about how to configure Account Security, see Configure account security.
Positive Security Model: Displays records of web application attacks that trigger protection rules automatically generated by the Positive Security Model. The records include Attacker IP Address, Region, Attack Time, Attack URL, Request Method, Action, Rule ID, and Attack Probability. You can specify a domain and a time range to filter the data.
Click View Details in the Actions column of a record to view the Attack Details.
For more information about how to configure the Positive Security Model, see Configure the positive security model.

Bot management report

The Bot Management report shows monitoring data for crawler requests and the performance of anti-bot rules for your website. You must select a domain from the protected domain list in the upper-left corner and specify a time range to view the protection data. WAF provides a separate protection performance report for each configured scenario-based anti-bot rule.

The Bot Management report is divided into two sections: Overview of Protection Effects and Scenario-specific Protection Effect. The Overview of Protection Effects section displays trend charts for the total number of requests, the number of identified bot requests, and the number of bot requests that triggered different protection rules.
Bot Requests: The total number of machine-generated requests identified through multi-dimensional traffic analysis. This metric helps you evaluate the effectiveness of your anti-bot rules. If the number of blocked requests is much lower than the number of identified bot requests, your rules may need optimization. If the numbers are close, the protection is performing well.
Requests Detected in Monitoring Mode: The number of requests that matched an anti-bot rule in Monitor mode. If you change the mode to Block, these requests will be blocked or challenged, for example, with a slider CAPTCHA.
Blocked Requests: The number of requests that matched an anti-bot rule with the action set to Block.

For more information about how to configure Bot Management, see the following topics:

Access Control/Throttling report

The Access Control/Throttling report displays records of web requests that have triggered HTTP Flood Protection, Scan Protection, and Access Control rules. You can specify a domain and a time range to search for data for the specified domain and time range. For records of interest, you can also query the related logs with a single click.

HTTP Flood Protection: Displays HTTP flood protection trends. This includes trend charts for Total QPS, Alert Rule of Custom HTTP Flood Protection, Block Rule of Custom HTTP Flood Protection, and Block Rule of Default HTTP Flood Protection, and the No. of matches for different Rule Type such as Alert Rule of Custom HTTP Flood Protection, Block Rule of Custom HTTP Flood Protection, and Block Rule of Default HTTP Flood Protection.
Click a Rule Type's No. of matches. You are redirected to the Log Service page, and a log query statement related to the HTTP Flood Protection module is automatically entered to help you query relevant logs. For more information, see Log Query. On the WAF Log Query page, in waf-logstore, use the query statement matched_host:"domain_name" and block_action: tmd to filter HTTP Flood Protection block logs, where block_action: tmd is the filter condition for HTTP Flood Protection blocks.
For more information about how to configure HTTP flood protection, see Configure HTTP flood protection.
For more information about how to configure custom HTTP flood protection rules, see Create a custom protection policy.
Scan Protection: Displays scan protection trends. This includes trend charts for Total QPS, Directory Traversal Prevention, Collaborative Protection, High-frequency Web Attack Blocking, and Scanner Blocking, and the No. of matches for different Rule Type such as Directory Traversal Prevention, Collaborative Protection, High-frequency Web Attack Blocking, and Scanner Blocking.
Click the No. of matches for a Rule Type to go to the Log Service page. A query statement for logs related to the Scan Protection module is automatically populated, allowing you to query the logs. For more information, see Query logs. On the WAF Query Logs page in the logstore named waf-logstore, you can add the block_action: antiscan condition to your query to filter logs for requests blocked by scan protection.
For more information about how to configure scan protection, see Configure scan protection.
Access Control: Displays access control trends. This includes trend charts for Total QPS, Alert Rules of ACL, Block Rules of ACL, and Blacklist protection, and a record of match counts for custom rules.
Click the Rule ID of a custom rule to open the Modify Rule dialog box, where you can view and modify its configuration. For more information, see Parameters for custom rules.
Click the No. of matches of a custom rule. You are redirected to the Log Service page, and a log query statement related to the Access Control module is automatically entered to help you further query related logs. For more information, see Log Query. On the WAF Log Query page, in the waf-logstore, use the query statement matched_host:"domain_name" and block_action: acl to filter access control block logs, where block_action: acl is the key condition for filtering ACL block records.
For more information about how to configure access control rules, see Create a custom protection policy.
For more information about how to configure an IP address blacklist, see Configure an IP address blacklist.