All Products
Search

This Product

    Web Application Firewall:Policy configuration

    Document Center

    Web Application Firewall:Policy configuration

    Last Updated:Oct 22, 2026

    This topic describes the built-in policies and custom policy configuration for Agentic API security. Building on its built-in detection mechanisms, Agentic API security supports custom detection policies tailored to your business. You can configure risk detection, security events, sensitive data, authentication credentials, business purposes, allowlists, lifecycle management, log subscription, and target objects to ensure the identified API data accurately reflects your business. This improves detection accuracy and recall, helping you respond effectively and reduce losses from attacks against your API business assets.

    Console

    1. Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.

    2. In the left-side navigation pane, choose Protection Config > API Security.

    3. Click the Policy Configurations tab.

    Risk Detection Configurations

    A risk is a security threat or vulnerability in an API caused by development, management, or configuration flaws. A security risk is a potential vulnerability, while a security event confirms that an attack has occurred and triggered an alert.

    WAF provides built-in policies and custom policies. If the built-in policies do not meet your business requirements, you can configure custom policies.

    Built-in policy

    On the Policy Configurations > Risk Detection Configurations tab, you can view the configured risk policies. All built-in policies are enabled by default. You can change their status and adjust their risk levels. Based on your business requirements, you can set the risk level of a built-in policy to "Low Risk", "Medium Risk", or "High Risk".

    Custom policy

    In addition to the built-in policies, you can create up to 20 custom policies.

    1. Go to the Policy Configurations > Risk Detection Configurations tab.

    2. In the Custom Policy section on the left, click New. In the panel that appears, configure the following settings.

      Parameter

      Description

      Risk Name

      Enter a descriptive name for the custom risk.

      Suggestions

      Enter the recommended action for this risk.

      Risk Level

      Set the risk level to low, medium, or high.

      Check Configurations

      Set the detection conditions for the custom policy. You can add up to 10 conditions.

      Specify the Match Field, Logical Operator, and Match Content. You can enter up to 50 values for the match content. Press Enter after each value. Risk Detection Configurations values are case-sensitive.

      For details on the supported configurations, see Description of Match Conditions (Risk Detection and Security Events).

    Security Event Configurations

    A security event is an anomalous API call or an attack, such as a brute-force attack on a login API or an SMS bombing attack that abuses an SMS API. WAF detects these events based on IP addresses and accounts.

    WAF provides built-in and custom policies. If the built-in policies do not meet your business requirements, you can configure custom policies.

    Built-in policy

    When a built-in policy for a security event triggers an alert, the system does not generate new alerts for the ongoing attack. Instead, it updates the attack time of the original alert, and the event's severity may change based on factors like attack volume.

    On the Policy Configurations > Security Event Configurations tab, you can view the built-in security event policies. All built-in policies are enabled by default. You can change their status and adjust the Event Level.

    Custom policy

    In addition to the built-in policies, you can create up to 10 custom policies.

    1. Go to the Policy Configurations>Security Event Configurations tab.

    2. In the Custom Policy section on the left, click New. In the panel that appears, configure the following settings.

      Parameter

      Description

      Event Name

      Enter a descriptive name for the custom event.

      Suggestions

      Provide a remediation suggestion for the custom security event based on your business needs.

      Event Level

      Set the event severity to Low, Medium, or High.

      Match Condition

      Configure the match conditions that trigger the custom security event. You can add up to 10 conditions.

      For details on supported configurations, see Match Condition Descriptions (Risk Detection and Security Events).

      Rate Limiting

      Specifies the Statistical Object (IP address or account), the Statistical Period (up to 15 minutes), and the Requests (must be a positive integer).

      Data Statistics

      Configure the statistical conditions for the custom security event. You can add up to 10 conditions.

      For details on supported configurations, see Data Statistics Descriptions (Security Events).

    Note

    • You can enter up to 50 match content values. Press Enter after each value to confirm.

    • If you define multiple conditions, a request must meet all conditions to trigger the rule.

    • The match content for Security Event Configurations is case-sensitive.

    III. Sensitive Data-related Configurations

    WAF detects both built-in and custom sensitive data types. The built-in types are enabled by default and can only be enabled or disabled. If the built-in types do not meet your business needs, you can configure up to 20 custom sensitive data types.

    Built-in Sensitive Data Types

    Go to the Policy Configurations > Sensitive Data-related Configurations > Built-in Sensitive Data Types tab. All built-in policies are enabled by default. You cannot edit or delete them; you can only enable or disable them.

    Custom Sensitive Data Types

    Go to the Policy Configurations > Sensitive Data-related Configurations > Custom Sensitive Data Types tab, click Create Policy, and configure the following parameters:

    Parameter

    Description

    Name

    Enter a name for the policy.

    Mode

    Sets the detection mode for the custom policy.

    • Basic: Provides a simplified configuration interface.

      After you select Basic, you must set the Characters and Length for detection.

      • Characters: Detects digits, uppercase letters, and lowercase letters. You can select multiple options.

      • Length: The detection length can range from 6 to 64. The start and end values must be integers.

    • Expert: Lets you specify a regular expression for detection. To avoid false positives, ensure that the expression matches a string of at least 6 characters.

    Sensitivity Level

    Sets the sensitivity level of the detected data. The options are: S1, S2, S3, and S4.

    Note

    For more information about sensitive data types, see What sensitive data types does Agentic API Security support?

    De-identification Display

    The Sensitive Data-related Configurations tab includes a De-identification Display switch. This switch is disabled by default, and no data is masked. When enabled, it masks the following information:

    Data masking rules

    • Risk Details and API Details: Sensitive data in request and response samples is replaced by default with the {{Phone}} placeholder.

    • Event Details: Request and response samples containing sensitive data are masked as {}.

    • Specific field masking:

      • Request cookies are masked as {{Cookie}}.

      • Request headers containing a token are masked as {{XXXToken}}.

      • Response Set-Cookie headers are masked as {{SetCookie}}.

    Scope

    • Risk Details and API Details: Applies only to new request and response samples.

    • Event Details: Applies to both new and existing request and response samples.

    IV. Disposal Policy Configuration

    The Disposal Policy Configuration tab provides the following features.

    • Schema Validation: Validates live requests and responses against the schema (API contract) configured for an API asset. At runtime, WAF compares traffic with the schema definition to identify requests that do not comply with the API contract and handles them based on the disposition action configured in the template. This helps you detect abnormal calls and API abuse.

    • API Real-Time Data Masking: Powered by the AI baseline engine, this feature automatically learns your API structure to identify sensitive data and perform fine-grained, automated data masking in real time. Because it does not require you to predefine fields, this feature adapts flexibly to complex business scenarios, helps you meet compliance requirements like cross-border data transfer, and delivers automated, real-time protection.

    Schema Validation

    Note

    Before configuring Schema Validation, you must first configure a schema for the API asset on the Asset Management tab.

    On the Policy Configurations > Disposal Policy Configuration tab, click Schema Validation in the list on the left, and then click Create Template to create a validation template.

    • Template Name: Enter a descriptive name for the template.

    • Rule Configuration: Click Create Rule to configure specific validation rules. You can configure multiple rules.

      • Rule Name: Enter a descriptive name for the rule.

      • Validation Details: Select one or more items to validate: Method, Path Parameter, Query Parameter, Header Parameter, and Cookie Parameter. WAF does not validate unselected items.

        • Method: Validates whether the method of the live request matches the one defined in the schema.

        • Path Parameter, Query Parameter, Header Parameter, and Cookie Parameter: Validates whether the request parameters in the corresponding locations comply with the schema definition (including whether the parameter is required, its type, format, and value constraints).

      • Data Processing Method: The supported actions are Monitor and Block.

        • Monitor: Allows requests that match the rule but logs the match. When testing a rule, you can start with the Log action and analyze WAF logs to check for false positives before changing the action.

        • Block: Blocks requests that match the rule and returns a block page to the client. By default, WAF uses a standard block page. You can also create a custom one by using the custom response feature.

    • Apply To: Specify the API assets that the template applies to. Each API asset can only be associated with one validation template.

    API Real-Time Data Masking

    On the Policy Configurations > Disposal Policy Configuration tab, click API Real-Time Data Masking in the list on the left, and then click Create Template to create a data masking template.

    • Template Name: Enter a descriptive name for the template.

    • Masking Rule Configuration: Click Create Rule to configure specific data masking rules. You can configure multiple rules.

      • Rule Name: Enter a descriptive name for the rule.

      • Sensitive Data Type: Select the data types to mask. Only built-in sensitive data types are supported.

      • Match Condition: Set the HTTP conditions that trigger the rule. You can configure up to five conditions. If you do not configure any, the rule matches all HTTP requests.

        Note

        If a rule includes multiple conditions, a request must meet all conditions (logical AND) to match the rule. For a detailed description of match fields and logical operators, see Match condition details.

      • Data Processing Method: The following two actions are supported:

        • Mask: Masks the data. You must also configure a specific Action. The supported actions are Clear and Masking.

        • Monitor: Does not mask data but logs when sensitive data is detected.

    • Apply To: Specify the API assets that the template applies to. Each API asset can only be associated with one data masking template.

    After you create a template, its data masking rules take 10 to 20 minutes to apply to newly added API assets. To view API data masking logs, go to the Security Reports page.

    Maintenance: You can manage existing templates and rules in the following ways:

    • Enable or disable templates and rules.

    • Add new rules to a template.

    • Edit templates and rules.

    • Delete templates and rules.

    V. Authentication Credential Configurations

    WAF provides built-in identification of authentication credentials and supports custom authentication credential configuration. If your service uses non-standard fields or fields with weak patterns (such as numeric-only values) as authentication credentials, you can create a custom policy to improve the accuracy of API security and unauthenticated risk identification. Follow these steps:

    1. Go to the Policy Configurations > Authentication Credential Configurations tab.

    2. Click Create Policy and configure the following settings.

      Parameter

      Description

      Name

      Enter a descriptive name for the policy.

      Match Condition

      Each match condition consists of a Match Field, Logical Operator, and Match Content. You can add up to 10 conditions. You must add at least one match condition for a request header, request cookie, request query, or request body. WAF combines multiple conditions with a logical AND, which means a request must satisfy all conditions to match the rule.

      Match content configuration: You can enter up to 50 values. Press Enter to confirm each value. For an Authentication Credential Configurations, the match content is case-sensitive. For more details, see Match condition description (authentication credential configuration).

    VI. Business Purpose

    WAF provides built-in and custom policies. If the built-in policies do not meet your business requirements, you can configure custom policies to improve Agentic API detection accuracy for specific business scenarios.

    Built-in Policy

    Go to the Policy Configurations > Business Purpose > Built-in Policy tab. These policies include data updates, data sharing, SMS sending, and message sending. By default, all built-in policies are enabled. You cannot edit or delete them, but you can enable or disable them.

    Custom Policy

    1. Go to the Policy Configurations>Business Purpose>Custom Policy tab.

    2. Click Create Policy and configure the following parameters.

      Parameter

      Description

      Name

      Enter a descriptive name for the policy.

      Match Condition

      Each condition consists of a Match Field, a Logical Operator, and Match Content. You can add up to 10 conditions.

      Match content configuration: You can enter up to 50 values, pressing Enter after each one. The match content in Business Purpose is case-sensitive. For details, see Description of match conditions (business purpose configuration).

    Configure Whitelist

    Agentic API Security lets you configure custom whitelists for risk detection and security events to filter out irrelevant alerts based on your business needs, such as those from your office network's egress IP addresses, and improve operational efficiency.

    Note

    Currently, you can only configure whitelists for Risk Detection and Security Events.

    1. Go to the Policy Configurations > Configure Whitelist tab.

    2. Click Create Policy and configure the following parameters.

      Parameter

      Description

      Name

      Enter a descriptive name for the policy.

      Type

      Select the whitelist type: Risk Detection or Security Events.

      Match Condition

      Each condition consists of a Match Field, a Logical Operator, and Match Content. You can add up to 10 conditions.

      Matching content configuration: You can enter up to 50 values. Press Enter after each value. The matching content in a Configure Whitelist is case-sensitive. For more information, see Description of matching conditions (whitelist configuration).

      Skipped Types

      From built-in or custom policies, select one or more risk detection or security event types to exclude.

    Lifecycle management

    Agentic API Security lets you customize criteria for inactive APIs by setting thresholds for daily visits and duration. This aligns inactive API detection with your business needs. API lifecycle management helps you identify and manage APIs that meet these standards. This prevents attackers from exploiting inactive APIs and reduces potential business losses.

    1. Go to the Policy Configurations > Lifecycle Management tab.

    2. Set the criteria for identifying an inactive API, and then click OK.

      Mode

      Description

      Built-in Model

      The system marks an API as inactive if it receives no traffic for 8 days or its traffic volume drops significantly.

      Custom

      This mode lets you define a threshold for daily visits and a duration of up to 31 days. If an API's daily visits fall below this threshold for the specified duration, the system marks it as inactive.

    Important

    If an asset's Last Active Time was more than 30 days ago, the system automatically deletes the asset and its associated risk data and security event records.

    IX. Log Subscription Configurations

    WAF supports delivering asset information, risk information, and attack event information from Agentic API security to a specified LogStore in Log Service (SLS) for centralized management and analysis.

    Note

    • Region restriction: WAF instances in the Chinese mainland can deliver logs only to a LogStore in the Chinese mainland. WAF instances outside the Chinese mainland can deliver logs only to a LogStore outside the Chinese mainland. Cross-region delivery is not supported.

    • Project and LogStore restrictions: You cannot select a LogStore for log subscriptions if it was automatically created by the WAF log service or if you have named it waf-logstore, wafng-logstore, or wafnew-logstore.

    Procedure

    1. Log on to the Log Service console and create a Project and a LogStore to receive Agentic API security logs. If you have already created them, skip this step. For more information, see Manage a Project.

    2. Return to the WAF console, and navigate to the Policy Configurations > Log Subscription Configurations tab.

    3. Select the log type to subscribe to and click Settings.

    4. Select the destination region, Project name, and LogStore name, and then click OK.

    Note

    You are charged by Log Service for operations in the Log Service console, such as creating Projects and LogStores and enabling indexing. For more information about billing items and pricing, see Log Service billing overview.

    Log subscription trigger conditions

    Log type

    Trigger condition

    Asset information logs

    Logs are delivered immediately when a new API asset is added. If no new assets are added, logs are delivered hourly by default.

    Risk information logs

    When new risk information is detected, logs are delivered in real time.

    Attack event information logs

    When a new attack event is detected, logs are delivered in real time. If the attack continues, logs are delivered every 10 minutes.

    Log fields: For a list of the delivered log fields, see Description of log subscription fields.

    Applicable Object Configurations

    Subscription WAF

    Agentic API Security provides three switches at the protected object or protected object group level:

    • Basic Detection switch: Enabled by default. Controls all built-in detection mechanisms and custom detection policies.

    • Compliance Check switch: Disabled by default. You can enable this switch only after enabling Basic Detection. Controls the Compliance Check feature.

    • Traceability switch: Disabled by default. You can enable this switch only after enabling Basic Detection. Controls the Traceability feature.

    Pay-as-you-go WAF

    Agentic API Security provides one switch at the protected object or protected object group level:

    • Basic Detection switch: Controls all built-in detection mechanisms and custom detection policies. To disable API security, turn off the Basic Detection switch for all protected objects and protected object groups.

    Appendix

    Match conditions for risk and security events

    Match field

    Sub-condition

    Logical operator

    Description

    Domain Name

    Not supported

    Contains One of Multiple Values, Does Not Contain Any Value, Equals One of Multiple Values, Does Not Equal Any Value

    You can enter up to 50 values. Press Enter after each value.

    API

    Not supported

    Contains One of Multiple Values, Does Not Contain Any Value, Equals One of Multiple Values, Does Not Equal Any Value

    You can enter up to 50 values. Press Enter after each value.

    Request Method

    Not supported

    Equals One of Multiple Values, Does Not Equal Any Value

    Select one or more request methods, such as GET, POST, DELETE, and PUT.

    User-Agent

    Not supported

    Contains One of Multiple Values, Does Not Contain Any Value, Equals One of Multiple Values, Does Not Equal Any Value

    You can enter up to 50 values. Press Enter after each value.

    Referer

    Not supported

    Contains One of Multiple Values, Does Not Contain Any Value, Equals One of Multiple Values, Does Not Equal Any Value

    You can enter up to 50 values. Press Enter after each value.

    Communication Protocol

    Not supported

    Equals

    Select HTTP or HTTPS.

    Request Content-Type

    Not supported

    Contains One of Multiple Values, Does Not Contain Any Value

    You can enter up to 50 values. Press Enter after each value.

    Request Length

    Not supported

    Equals, Value Less Than, Value Greater Than

    Enter an integer from 0 to 8192.

    Response Content-Type

    Not supported

    Contains One of Multiple Values, Does Not Contain Any Value

    You can enter up to 50 values. Press Enter after each value.

    Response Length

    Not supported

    Equals, Value Less Than, Value Greater Than

    Enter an integer from 0 to 8192.

    HTTP Status Code

    Not supported

    Equals One of Multiple Values, Does Not Equal Any Value

    You can enter up to 50 values. Press Enter after each value.

    Request Header

    custom header

    Exists, Does Not Exist, Length Equal To, Length Less Than, Length Greater Than, Contains One of Multiple Values, Does Not Contain Any Value

    -

    Cookie Parameter

    Custom Cookie-Exact

    Exists, Does Not Exist, Length Equal To, Length Less Than, Length Greater Than, Contains One of Multiple Values, Does Not Contain Any Value

    -

    GET Parameter

    Custom Parameter

    Exists, Does Not Exist, Length Equal To, Length Less Than, Length Greater Than, Contains One of Multiple Values, Does Not Contain Any Value

    -

    POST Parameter

    Custom Post-Arg

    Exists, Does Not Exist, Length Equal To, Length Less Than, Length Greater Than, Contains One of Multiple Values, Does Not Contain Any Value

    -

    Response Header

    response header

    Exists, Does Not Exist, Length Equal To, Length Less Than, Length Greater Than, Contains One of Multiple Values, Does Not Contain Any Value

    -

    Response Parameter

    response parameter

    Exists, Does Not Exist, Length Equal To, Length Less Than, Length Greater Than, Contains One of Multiple Values, Does Not Contain Any Value

    -

    Purpose

    Not supported

    Equals One of Multiple Values, Does Not Equal Any Value

    Select one or more business purposes from the list. For more information, see How does Agentic API security classify API business purposes?

    Service Object

    Not supported

    Equals One of Multiple Values, Does Not Equal Any Value

    Select one or more service objects from the list. For more information, see How does Agentic API security distinguish API service objects?

    Authentication

    Not supported

    Equals

    Yes/No

    Request Sensitive Data Type

    Not supported

    Equals One of Multiple Values, Does Not Equal Any Value, Category Count Greater Than

    Select one or more sensitive data types from the list. If you use the Number of Types Greater Than operator, enter an integer from 0 to 8192.

    Sensitivity Level of Request Sensitive Data

    Not supported

    Equals One of Multiple Values, Does Not Equal Any Value

    Select one or more levels from S1 to S4.

    Response Sensitive Data Type

    Not supported

    Equals One of Multiple Values, Does Not Equal Any Value, Category Count Greater Than

    Select one or more sensitive data types from the list. If you use the Number of Types Greater Than operator, enter an integer from 0 to 8192.

    Sensitivity Level of Response Sensitive Data

    Not supported

    Equals One of Multiple Values, Does Not Equal Any Value

    Select one or more levels from S1 to S4.

    Source Location

    Not supported

    Equals

    Chinese Mainland/Outside Chinese Mainland

    IP address

    Not supported

    Belongs To, Does Not Belong To

    Enter an IP address or a CIDR block (e.g., 1.1.X.X/24). Regular expressions are not supported. You can enter up to 50 values, separated by commas or line breaks.

    Account (security events only)

    Not supported

    Equals One of Multiple Values, Does Not Equal Any Value

    You can enter up to 50 values. Press Enter after each value.

    Security event statistics

    Match field

    Sub-condition

    Logical operator

    Value

    Status Code Statistics

    Status code (an integer from 100 to 600)

    Value Greater Than

    An integer from 0 to 8192.

    Request Header

    custom header

    Distinct Less Than, Distinct Equals, Distinct Greater Than

    An integer from 0 to 8192.

    Cookie Parameter

    custom cookie-exact

    Distinct Less Than, Distinct Equals, Distinct Greater Than

    An integer from 0 to 8192.

    GET Parameter

    custom parameter

    Distinct Less Than, Distinct Equals, Distinct Greater Than

    An integer from 0 to 8192.

    POST Parameter

    custom POST parameter

    Distinct Less Than, Distinct Equals, Distinct Greater Than

    An integer from 0 to 8192.

    Response Sensitive Data Type

    One or more response sensitive data types.

    Distinct Greater Than

    An integer from 0 to 8192.

    Sensitivity Level of Response Sensitive Data

    One or more response sensitive data levels.

    Distinct Greater Than

    An integer from 0 to 8192.

    Source IP Count

    The threshold for the source IP count.

    Value Greater Than

    An integer from 0 to 8192.

    Note

    By default, Agentic API Security analyzes sensitive data in responses using sampling. To configure Data Statistics detection for Response Sensitive Data Type and Sensitivity Level of Response Sensitive Data in a Custom Policy under Security Event Configurations, enable the Traceability switch for the corresponding protected object in Policy Configurations > Applicable Object Configurations. This ensures that all sensitive data in responses from the protected object is fully recorded and analyzed.

    Authentication match conditions

    Match field

    Sub-condition

    Logical operator

    Description

    Domain Name

    Not supported

    Contains One of Multiple Values, Does Not Contain Any Value, Equals One of Multiple Values, Does Not Equal Any Value

    Enter up to 50 values. Press Enter after each value.

    API

    Not supported

    Contains One of Multiple Values, Does Not Contain Any Value, Equals One of Multiple Values, Does Not Equal Any Value

    Enter up to 50 values. Press Enter after each value.

    Request Header

    custom header

    Exists, Length Equal To, Length Less Than, Length Greater Than

    Request Cookie

    custom cookie-exact

    Exists, Length Equal To, Length Less Than, Length Greater Than

    Request Query

    custom parameter

    Exists, Length Equal To, Length Less Than, Length Greater Than

    Request Body

    custom post-arg

    Exists, Length Equal To, Length Less Than, Length Greater Than

    Business purpose configuration

    Match field

    Logical operator

    Value

    Domain Name

    Contains One of Multiple Values, Does Not Contain Any Value, Equals One of Multiple Values, Does Not Equal Any Value

    Enter up to 50 values, pressing Enter after each.

    API

    Contains One of Multiple Values, Does Not Contain Any Value, Equals One of Multiple Values, Does Not Equal Any Value

    Enter up to 50 values, pressing Enter after each.

    Request Header Parameter Name

    Contains One of Multiple Values, Equals One of Multiple Values

    Enter up to 50 values, pressing Enter after each.

    Request Cookie Parameter Name

    Contains One of Multiple Values, Equals One of Multiple Values

    Enter up to 50 values, pressing Enter after each.

    Request Query Parameter Name

    Contains One of Multiple Values, Equals One of Multiple Values

    Enter up to 50 values, pressing Enter after each.

    Request Body Parameter Name

    Contains One of Multiple Values, Equals One of Multiple Values

    Enter up to 50 values, pressing Enter after each.

    Request Sensitive Data Type

    Contains One of Multiple Values, Equals One of Multiple Values

    Select one or more sensitive data types.

    Response Sensitive Data Type

    Contains One of Multiple Values, Equals One of Multiple Values

    Select one or more sensitive data types.

    Response Parameter Name

    Contains One of Multiple Values, Equals One of Multiple Values

    Enter up to 50 values, pressing Enter after each.

    Match conditions (allow list)

    Risk detection allowlist

    Match field

    Logical operator

    Value

    Domain Name

    Contains One of Multiple Values, Does Not Contain Any Value, Equals One of Multiple Values, Does Not Equal Any Value

    Enter up to 50 values. Press Enter after each one.

    API

    Contains One of Multiple Values, Does Not Contain Any Value, Equals One of Multiple Values, Does Not Equal Any Value

    Enter up to 50 values. Press Enter after each one.

    Security event allowlist

    Match field

    Logical operator

    Value

    Domain Name

    Contains One of Multiple Values, Does Not Contain Any Value, Equals One of Multiple Values, Does Not Equal Any Value

    Enter up to 50 values. Press Enter after each one.

    API

    Contains One of Multiple Values, Does Not Contain Any Value, Equals One of Multiple Values, Does Not Equal Any Value

    Enter up to 50 values. Press Enter after each one.

    IP

    Belongs To, Does Not Belong To

    Enter an IP address or a CIDR block (for example, 1.1.X.X/24). Regular expressions are not supported. Enter up to 50 entries. Separate them with commas, or press Enter after each entry.

    Account

    Contains One of Multiple Values, Does Not Contain Any Value, Equals One of Multiple Values, Does Not Equal Any Value

    Enter up to 50 values. Press Enter after each one.

    Log subscription delivery fields

    Assets

    Parameter

    Description

    Format

    Example

    user_id

    The customer's user ID.

    string

    123456

    service_host

    The domain name that hosts the API.

    string

    api.alibabacloud.com

    api_format

    The API path.

    string

    /api/v1/getuserbyid/${param}

    request_method

    The request method.

    string

    GET

    api_tag

    An array indicating the business purpose.

    array

    ['QueryInfo']

    api_type

    An array indicating the service target.

    array

    ['PublicAPI']

    auth_key

    An array of authentication field names used by the API.

    array

    ['id_token', 'access_token']

    api_status

    The API's lifecycle status.

    string

    NewbornInterface

    api_sensitive_level

    The API sensitivity level.

    string

    L1

    api_sensitive_req

    An array of IDs for detected request sensitive data types.

    array

    ['1014', '1017', '1002']

    api_sensitive_res

    An array of IDs for detected response sensitive data types.

    array

    ['1009', '1013', '1003', '1014', '1002']

    farthest_ts

    The API's first discovery time, as a Unix timestamp.

    long

    1713237135

    latest_ts

    The API's last active time, as a Unix timestamp.

    long

    1716452318

    abnormal_num

    The total number of risks for the API.

    integer

    1

    event_num

    The total number of events for the API.

    integer

    2

    struct_baseline

    An array of JSON strings, each describing a learned parameter structure.

    array

    ['{"key":"Trace-Id","location":"request_header","format":"string","required":"true"}',

    '{"key":"pageNum","location":"request_query","format":"integer","required":"true"}',

    '{"key":"tlogTraceId","location":"response_header","format":"integer","required":"true"}',

    '{"key":"Strict-Transport-Security","location":"request_header","format":"string","required":"true"}',

    '{"key":"X-Forwarded-ClientSrcPort","location":"request_header","format":"integer","required":"true"}',

    '{"key":"Trace-State","location":"request_header","format":"string","required":"true"}',

    '{"key":"auth","location":"request_header","format":"string","required":"true"}',

    '{"key":"Access-Control-Max-Age","location":"response_header","format":"integer","required":"true"}',

    '{"key":"Enterprise-Hash","location":"request_header","format":"string","required":"true"}',

    '{"key":"X-Request-ID","location":"request_header","format":"string","required":"true"}',

    '{"key":"postName","location":"request_query","format":"string","required":"true"}', '{"key":"pageSize","location":"request_query","format":"integer","required":"true"}']

    matched_hosts

    An array of protected object identifiers.

    array

    ['*.aliyun.com-waf']

    hosts

    An array of domain names for the API.

    array

    ['api.alibabacloud.com']

    server_port

    An array of server ports.

    array

    ['443']

    server_location

    An array of country codes for the origin server country.

    array

    ['CN']

    api_id

    The unique API ID.

    string

    af418cb31036015fddea71b48d06aa4b

    log_type

    The log type. For asset information, the value is asset.

    string

    asset

    request_header

    The request header.

    JSON

    {"Connection":"Keep-Alive","Host":"api.alibabacloud.com","eagleeye-rpcid":"0.1"}

    querystring

    The request URL's query string.

    string

    ?token=7464f593205896e23b1286ba7532dcff

    request_body

    The request body.

    string

    xxx=1

    response_header

    The response header.

    JSON

    {"Accept-Ranges":["bytes","bytes"],"Cache-Control":"private, max-age=21600, no-transform"}

    response_body

    The response body.

    string

    xxxx

    example_timestamp

    A sample timestamp.

    long

    1718546694

    example_traceid

    A sample trace ID.

    string

    784e2ca717213678365778292e58de

    Risks

    Parameter

    Description

    Format

    Example

    user_id

    The customer's user ID.

    string

    123456

    service_host

    The domain name that hosts the API.

    string

    api.alibabacloud.com

    api_format

    The API path.

    string

    /api/v1/login

    request_method

    The request method.

    string

    POST

    api_tag

    An array indicating the business purpose.

    array

    ['LoginAPI']

    abnormal_tag

    The risk name.

    string

    Risk_DefaultPasswd

    abnormal_type

    The risk type. Valid values are default (built-in) and custom.

    string

    default

    abnormal_level

    The risk level.

    string

    medium

    abnormal_discover_ts

    The risk discovery time, as a Unix timestamp.

    long

    1716343432

    abnormal_info

    Additional risk information, in key-value format.

    object

    {'default_passwd':'aliyun123'}

    api_id

    The unique API ID.

    string

    2c0f97e10b586208039e60671150bd9b

    abnormal_id

    The unique risk ID.

    string

    8cfccc0e8c3d41aa1221e94a2fdeffe3

    log_type

    The log type. For risk information, the value is risk.

    string

    risk

    matched_hosts

    An array of protected object identifiers.

    array

    ['*.aliyun.com-waf']

    request_header

    The request header.

    JSON

    {"Connection":"Keep-Alive","Host":"api.alibabacloud.com","eagleeye-rpcid":"0.1"}

    querystring

    The query string from the request URL.

    string

    ?token=7464f593205896e23b1286ba7532dcff

    request_body

    The request body.

    string

    xxx=1

    response_header

    The response header.

    JSON

    {"Accept-Ranges":["bytes","bytes"],"Cache-Control":"private, max-age=21600, no-transform"}

    response_body

    The response body.

    string

    xxxx

    example_timestamp

    A sample timestamp.

    long

    1718546694

    example_traceid

    A sample trace ID.

    string

    784e2ca71721367836577858de

    Attack events

    Parameter

    Description

    Format

    Example

    user_id

    The customer's user ID.

    string

    123456

    service_host

    The domain name that hosts the API.

    string

    api.alibabacloud.com

    matched_host

    The protected object that was targeted.

    string

    api.alibabacloud.com-waf

    host

    The domain name.

    string

    api.alibabacloud.com

    api_format

    The API path.

    string

    /api/admin/login

    request_method

    The request method.

    string

    POST

    api_tag

    An array indicating the business purpose.

    array

    ['AdminService', 'LoginService']

    event_tag

    The event name.

    string

    Event_LoginCollision

    event_origin

    The event type. Valid values are default (built-in) and custom.

    string

    default

    event_level

    The event level.

    string

    high

    start_ts

    The attack start time, as a Unix timestamp.

    long

    1713886210

    end_ts

    The attack end time, as a Unix timestamp.

    long

    1713887817

    attack_cnt

    The total attack count.

    integer

    147

    attack_ip_info

    An array of objects containing attacker IP information. Each object includes the IP (ip), country ID (country_id), region ID (region_id), and attack count (cnt).

    array

    [{"ip": "103.44.XX.XXX", "country_id": "HK", "region_id": "-", "cnt": "147"}]

    api_id

    The unique API ID.

    string

    4dfc73b37d2d645fe2ca7f45c08f7398

    event_id

    The event ID.

    string

    f09f6802e9b57a58ebb9f1bea212027e

    log_type

    The log type. For attack events, the value is event.

    string

    event

    request_data

    Sample request data. This field maps sensitive data type IDs to an array of detected values.

    JSON

    {"1002":["John Doe","Jane Smith","Sam Chen"],"1004":["13200000001","15200000002"]}

    response_data

    Sample response data. This field maps parameter names to an array of detected values.

    JSON

    {'postarg.userId':['lisi111','zhangsan123'],'postarg.corpId':['wx1111111'],'postarg.externalUserid':['wm7_KpDgOm6Bm-BGA']}

    Log subscription field values

    Lifecycle

    Lifecycle (api_status)

    Value

    Description

    NewbornInterface

    New.

    OfflineInterface

    Inactive.

    normal

    Normal.

    API type

    API type (api_type)

    Value

    Description

    PublicAPI

    public API

    ThirdPartyAPI

    third-party API

    InternalAPI

    internal API

    Use case

    use case (api_tag)

    Value

    Description

    LoginByUserPasswd

    username and password login

    LoginByPhoneCode

    phone verification code login

    LoginByMailCode

    email verification code login

    WeChatLogin

    WeChat login

    AliPayLogin

    Alipay login

    OAuthLogin

    OAuth authentication

    OIDCLogin

    OIDC authentication

    SAMLLogin

    SAML authentication

    SSOLogin

    SSO authentication

    LoginAPI

    login service

    LogoutAPI

    log out

    RegisterByUserPasswd

    username and password registration

    RegisterByPhoneCode

    phone verification code registration

    RegisterByMailCode

    email verification code registration

    WeChatRegister

    WeChat registration

    AliPayRegister

    Alipay registration

    RegisterAPI

    registration service

    SendSMS

    send SMS

    SendMail

    send email

    ResetPasswd

    Password reset

    CheckVerifyCode

    verification code validation

    CheckStatus

    status check

    QueryOrder

    Order query

    ExportOrder

    Order export

    UpdateOrder

    Order update

    PayOrder

    order payment

    QueryLog

    Log query

    UploadLog

    log reporting

    DownloadLog

    Log export

    LogService

    Log Service

    GraphQL

    GraphQL

    SqlService

    SQL service

    FileUpload

    file upload

    FileDownload

    file download

    FileService

    file service

    AdminService

    backend management

    DashBoard

    dashboard

    MonitorService

    monitoring service

    SendInfo

    send information

    CheckInfo

    data check

    QueryInfo

    Data query

    UploadInfo

    Data upload

    DownloadInfo

    Data download

    AddInfo

    Data addition

    EditInfo

    Data editing

    UpdateInfo

    Data update

    ShareInfo

    Data sharing

    DeleteInfo

    Data deletion

    SyncInfo

    data synchronization

    SubmitInfo

    Data submission

    CopyInfo

    Data copy

    AuditInfo

    data audit

    SaveInfo

    Data saving

    CancelOp

    cancel

    StartOp

    start

    BatchOp

    Batch processing

    PauseOp

    pause

    BindOp

    bind

    DebugOp

    Debug

    SetOp

    set

    ShutDown

    Shutdown

    Sensitive data types

    This field specifies the request sensitive data type (api_sensitive_req) and the response sensitive data type (api_sensitive_res).

    Value

    Description

    1000

    ID card number (Chinese mainland)

    1001

    debit card

    1002

    full name (Simplified Chinese)

    1003

    address (Chinese mainland)

    1004

    mobile number (Chinese mainland)

    1005

    email address

    1006

    passport number (Chinese mainland)

    1007

    Mainland Travel Permit for Hong Kong and Macao Residents

    1008

    license plate number (Chinese mainland)

    1009

    phone number (Chinese mainland)

    1010

    military officer card

    1011

    gender

    1012

    ethnic group

    1013

    province (Chinese mainland)

    1014

    city (Chinese mainland)

    1015

    ID card number (Hong Kong, China)

    1016

    full name (Traditional Chinese)

    1017

    full name (English)

    1018

    ID card number (Malaysia)

    1019

    ID card number (Singapore)

    1020

    credit card

    1022

    SWIFT code

    1023

    SSN

    1024

    telephone number (United States)

    1025

    religious belief

    2000

    IP address

    2001

    MAC address

    2002

    JDBC connection string

    2003

    PEM certificate

    2004

    private key

    2005

    AccessKey ID

    2006

    AccessKey Secret

    2007

    IPv6 address

    2009

    date

    2010

    IMEI

    2011

    MEID

    2013

    Linux passwd file

    2014

    Linux shadow file

    2015

    URL

    4000

    business license number

    4001

    tax registration certificate number

    4002

    organization code

    4003

    Unified Social Credit Code

    4004

    vehicle identification number (VIN)

    Risk type

    risk type

    Value

    Description

    RiskType_Specification

    security specification

    Risk_UnsafeHttpMethod

    unsafe HTTP method

    Risk_WeakSignAlgorithm

    weak JWT signing algorithm

    Risk_UrlParam

    URL as a parameter

    RiskType_Account

    account security

    Risk_PasswdUnencrypt

    plaintext password transmission

    Risk_WeakPasswd

    weak password allowed

    Risk_InternalWeakPasswd

    weak credentials in internal applications

    Risk_DefaultPasswd

    Default password present

    Risk_PasswdResponse

    plaintext password returned

    Risk_PasswdCookie

    password stored in cookies

    Risk_LoginRestrict

    lack of login attempt limits

    Risk_LoginPrompt

    improper login failure prompt

    Risk_PasswdUrl

    credentials transmitted via URL

    RiskType_Control

    access control

    Risk_InternalAPI

    internal application accessible from the public network

    Risk_SourceRestrict

    No source restriction on the API

    Risk_ClientRestrict

    No client tool restriction on the API

    Risk_SpeedRestrict

    no rate limiting on the API

    RiskType_Permission

    permission management

    Risk_WeakToken

    weak authentication credential

    Risk_UnauthSensitive

    sensitive API without authentication

    Risk_UnauthInternalAPI

    internal API accessible without authorization

    Risk_TokenUrl

    credentials transmitted via URL

    Risk_AkLeak

    Access Key leakage

    RiskType_Sensitive

    data protection

    Risk_SensitiveTypeExcessive

    excessive types of sensitive data returned

    Risk_SensitiveNumExcessive

    excessive amount of sensitive data returned

    Risk_InvalidDesensitize

    ineffective sensitive data desensitization

    Risk_ServerInfoLeak

    sensitive server information leakage

    Risk_InternalIPLeak

    internal IP address leakage

    Risk_SensitiveURL

    sensitive data transmitted via URL

    RiskType_Design

    API design

    Risk_ParamTraverse

    iterable request parameters

    Risk_PageSize

    Modifiable response page size

    Risk_SqlAPI

    Database query API

    Risk_RceAPI

    command execution API

    Risk_SmsContent

    Sending arbitrary SMS content

    Risk_MailContent

    Sending arbitrary email content

    Risk_SmsVerifyCodeLeak

    SMS verification code leakage

    Risk_MailVerifyCodeLeak

    email verification code leakage

    Risk_FileDownload

    Arbitrary file download

    Risk_ExceptionLeak

    application exception information leakage

    Risk_ExceptionSql

    database exception information leakage

    Event type

    event

    Value

    Description

    Event_AbnormalFrequency

    abnormal high-frequency access

    Event_ExceptionIPInvoke

    internal API access from an abnormal IP address

    Event_ExceptionRegionInvoke

    internal API access from an abnormal region

    Event_ExceptionClientInvoke

    access from an abnormal client

    Event_ExceptionTimeInvoke

    access during an unusual time period

    Event_AbnormalParamValue

    access with an abnormal parameter value

    Event_InternalLoginWeakPasswd

    internal application login with a weak password

    Event_LoginAccountBruteForce

    username brute-force attack

    Event_LoginPasswdBruteForce

    password brute-force attack

    Event_LoginCollision

    credential stuffing attack

    Event_MobileVerifyBruteForce

    SMS verification code brute-forcing

    Event_MailVerifyBruteForce

    email verification code brute-forcing

    Event_AbnormalRegister

    bulk registration

    Event_SMSInterfaceAbuse

    SMS resource abuse

    Event_EmailInterfaceAbuse

    email resource abuse

    Event_AbnormalExport

    bulk download

    Event_DataTraverse

    data scraping through API traversal

    Event_WebAttackAPI

    malicious attack on API

    Event_ObtainSensitiveUnauthorized

    unauthorized access to sensitive data

    Event_ObtainSensitiveExcessive

    excessive access to sensitive data

    Event_CrossborderIPSensitiveExcessive

    excessive access to sensitive data from an overseas IP address

    Event_ExceptionResponse

    API response with an exception message

    Event_ExceptionSql

    API response with a database error message

    Event_SystemInfoResponse

    API response containing sensitive system information

    Event_AbnormalStatus

    API response with an abnormal status