Web Application Firewall:Configure CloudMonitor notifications

Create an alert contact or alert contact group

1. Log on to the CloudMonitor console.
2. In the left-side navigation pane, choose Alerts > Alert Contacts.
3. Create an alert contact.
   1. On the Alert Contacts tab, click Create Alert Contact.
   2. In the Set Alert Contact panel, enter the name, email address, and webhook URL of the alert contact. Make sure that the Language of Alert Notifications parameter is set to the default value Automatic.
      Note Automatic specifies that CloudMonitor automatically selects the language of alert notifications based on the language that is used to create your Alibaba Cloud account.
   3. Verify the parameters and click OK.
4. Create an alert group.
   1. On the Alert Contact Group tab, click Create Alert Contact Group.
   2. In the Create Alert Contact Group panel, enter a name for the alert contact group and add alert contacts to the alert contact group. Then, click Confirm.
5. Add multiple alert contacts to an alert contact group.
   1. On the Alert Contacts tab, select the alert contacts that you want to add to an alert contact group and click Add to Alert Contact Group.
   2. In the Confirm dialog box, select the alert contact group to which you want to add alert contacts and click OK.
   After you create alert contacts and an alert contact group and add the alert contacts to the alert contact group, the alert contacts can receive the monitoring and alerting notifications. Alert contacts must check the alert notifications and handle the alerts at the earliest opportunity.

Configure monitoring and alerting for attack events

1. Log on to the CloudMonitor console.
2. In the left-side navigation pane, choose Event Monitoring > System Event.
3. On the Event-triggered Alert Rules tab, click Create Alert Rule.
4. In the Create/Modify Event-triggered Alert Rule panel, configure the following parameters and click OK.

   Parameter	Description
   Alert Rule Name	The name of the event-triggered alert rule.
   Product Type	The cloud service for which you want to configure an event-triggered alert rule. Select Web Application Firewall (WAF).
   Event Type	The type of the event for which you want the alert rule to take effect. Valid values: Attack and Exceed.
   Event Level	The level of the event for which you want the system to trigger alerts. The security level of all events that are detected by WAF is CRITICAL.
   Event Name	The name of the event that triggers alerts. Note In the Event Name drop-down list, events whose names contain v3 are WAF 3.0 events that can be monitored by CloudMonitor. The other events are WAF 2.0 events. For information about the attack events that are detected by WAF 2.0 and can be monitored by CloudMonitor, see Attack events that can be monitored by CloudMonitor.
   Keyword Filtering	The keywords that you want to use in the alert rule. Valid values: Contains any of the keywords: If an attack event contains one of the specified keywords, no alert notifications are sent. Does not contain any of the keywords: If an attack event does not contain any of the specified keywords, no alert notifications are sent.
   SQL Filter	The SQL statements that you want to use for filtering.
   Resource Range	The range of resources for which you want the event-triggered rule to take effect. Valid values: All Resources and Application Groups.
   Contact Group	The contact groups to which you want to send alert notifications. For more information, see Create an alert contact or alert contact group.
   Notification Method	The severity level and notification method of the event-triggered alert. Valid values: Critical (Phone Call + Text Message + Email + Webhook) Warning (SMS + Text Message + Webhook) Info (Email + Webhook)
   MNS Queue	The Message Service (MNS) queue to which you want to deliver the event alert.
   Function Compute	The Function Compute function to which you want to deliver the event alert.
   URL Callback	The URL that you want to use to receive the alert notifications that are sent from CloudMonitor by using HTTP POST requests. Make sure that the URL can be accessed over the Internet. Only HTTP requests are supported. For information about how to configure alert callbacks, see Configure callbacks for system event-triggered alerts.
   Log Service	The Log Service Logstore to which you want to deliver the event alert.
   Mute For	The interval at which you want CloudMonitor to resend alert notifications when the alert is not cleared. Valid values: 5 Minutes, 15 Minutes, 30 Minutes, 60 Minutes, 3 Hours, 6 Hours, 12 Hours, and 24 Hours.

   After you configure an alert rule for attack events, the contacts that you specified in the alert rule can receive alert notifications when specific attacks are detected on the protected objects of WAF.

   To query the recent attack events that are detected by WAF, choose Event Monitoring > System Event in the left-side navigation pane and click the Event Monitoring tab. On the Event Monitoring tab, select Web Application Firewall (WAF) from the All Products drop-down list and select an event name that does not contain v3 from the Select Event Name drop-down list. Then, click Search.

Configure monitoring and alerting for WAF metrics

1. Log on to the CloudMonitor console.
2. In the left-side navigation pane, choose Alerts > Alert Rules.
3. On the Alert Rules page, click Create Alert Rule.
4. In the Create Alert Rule panel, configure the following parameters and click OK.

   Parameter	Description
   Product	Select Web Application Firewall (WAF) from the Product drop-down list.
   Resource Range	The range of resources for which you want the alert rule to take effect. Valid values: All Resources: The alert rule takes effect for all WAF resources. Application Groups: The alert rule takes effect for all resources in a specified application group of WAF. Instances: The alert rule takes effect for the specified resources of WAF.
   Rule Description	The content of the alert rule. If a metric meets the specified condition, an alert is triggered. To specify the rule description, perform the following operations: Click Add Rule. In the Add Rule Description panel, configure the Alert Rule, Metric Type, Metric, and Threshold and Alert Level parameters. Then, click OK. Note For information about the WAF metrics that can be monitored by CloudMonitor, see WAF service metrics that can be monitored by CloudMonitor.
   Mute For	The interval at which you want CloudMonitor to resend alert notifications when the alert is not cleared. Valid values: 5 Minutes, 15 Minutes, 30 Minutes, 60 Minutes, 3 Hours, 6 Hours, 12 Hours, and 24 Hours. An alert is triggered when the conditions of an alert rule are met. CloudMonitor does not resend an alert notification if the alert is triggered during the mute period. If the alert is not cleared after the mute period elapses, CloudMonitor resends alert notifications.
   Effective Period	The period of time during which you want the alert rule to take effect. CloudMonitor monitors the specified resources based on the alert rule only within the specified period of time.
   Alert Contact Group	The contact groups to which you want to send alert notifications. For more information, see Create an alert contact or alert contact group.
   Alert Callback	The URL that you want to use to receive the alert notifications that are sent from CloudMonitor by using HTTP POST requests. Make sure that the URL can be accessed over the Internet. Only HTTP requests are supported. For information about how to configure alert callbacks, see Use the alert callback feature to send notifications about threshold-triggered alerts. Note You can click Advanced Settings to configure this parameter.
   Auto Scaling (The corresponding scaling rule will be triggered when the alert occurs.)	If you turn on Auto Scaling (The corresponding scaling rule will be triggered when the alert occurs.) and an alert is triggered, the specified scaling rule is enabled. In this case, you must configure the Region, ESS Group, and ESS Rule parameters. For information about how to create a scaling group, see Manage scaling groups. For information about how to create a scaling rule, see Manage scaling rules. Note You can click Advanced Settings to configure this parameter.
   Log Service (If you select Log Service, the alert information will be written to Log Service.)	If you turn on Log Service (If you select Log Service, the alert information will be written to Log Service.) and an alert is triggered, the alert information is written to the specified Logstore in Log Service. In this case, you must configure the Region, ProjectName, and Logstore parameters. For information about how to create a project and a Logstore, see Getting Started. Note You can click Advanced Settings to configure this parameter.
   Message Service - topic	If you turn on Message Service - topic and an alert is triggered, the alert information is written to the specified topic in MNS. In this case, you must configure the Region and topicName parameters. For information about how to create a topic, see Create a topic. Note You can click Advanced Settings to configure this parameter.
   Method to handle alerts when no monitoring data is found	The method that you want to use to handle alerts when no monitoring data is found. Valid values: Do not do anything (default value) Send alert notifications Treated as normal Note You can click Advanced Settings to configure this parameter.
   Tag	The tags of the alert rule. A tag consists of a tag name and a tag value.

   After you create an alert rule, you can view the rule on the Alert Rules page. Select WAF 3.0 from the Product drop-down list and domain from the Metric drop-down list. Then, select one of the metrics that are displayed on the right side to search for the alert rule that you created for the metric.

   Note Descriptions of WAF metrics that can be monitored by CloudMonitor:

   • If you select domain from the Metric drop-down list, the metrics that are displayed on the right side are WAF 2.0 metrics that can be monitored by CloudMonitor.
   • If you select resource from the Metric drop-down list, the metrics that are displayed on the right side are WAF 3.0 metrics that can be monitored by CloudMonitor.
   • If you select Instance from the Metric drop-down list, the metrics that are displayed on the right side are Hybrid Cloud WAF metrics that can be monitored by CloudMonitor. Metrics whose names contain v3 are WAF 3.0 metrics that can be monitored by CloudMonitor. The other metrics are WAF 2.0 metrics.

Configure monitoring and alerting for custom metrics

You can use Log Service to configure monitoring and alerting for custom metrics. For more information, see Use Log Service to configure monitoring and alerting.

Attack events that can be monitored by CloudMonitor

CloudMonitor allows you to configure monitoring and alerting for web attacks, HTTP flood attacks, scan attacks, and unauthorized access control events on domain names that are added to WAF. You can select a notification method by which you want to receive alerts based on the severity level of events. The notification methods include text messages, emails, DingTalk, or the alert callback feature. For more information, see Configure monitoring and alerting for attack events.

WAF service metrics that can be monitored by CloudMonitor