Todos los productos
Search

Este producto

    Web Application Firewall:Ejemplos de configuración de alertas para registros de WAF

    Centro de documentos

    Web Application Firewall:Ejemplos de configuración de alertas para registros de WAF

    Última actualización: Sep 04, 2026

    Este tema proporciona ejemplos de configuraciones de alertas para los registros de Web Application Firewall (WAF). Utilice estos ejemplos para agregar gráficos de monitoreo a un panel de registros de WAF y configurar alertas.

    Importante

    Los parámetros de configuración de alertas en este tema aplican a la función de alertas original de Log Service. Si utiliza la nueva función de alertas, aún puede usar las sentencias de consulta y los ajustes de parámetros recomendados. Para obtener más información, consulte Alert configuration quick start.

    Alerta por porcentaje anómalo de 4xx

    Parámetros de alerta recomendados:

    • Chart Name: 4xx Percentage (Blocked Requests Ignored)

    • Search Statement:

      user_id:

      Este gráfico contiene los siguientes campos: aveQPS, 2xx ratio, 3xx ratio, 4xx ratio y 5xx ratio, que representan las consultas por segundo (QPS) de un nombre de dominio y la proporción de cada tipo de código de estado, respectivamente. El campo 4xx ratio excluye los códigos de estado 444 y 405 causados por ataques de inundación HTTP y ataques web bloqueados por Web Application Firewall (WAF). Esto garantiza que solo se muestren los cambios en los códigos de estado provocados por sus propios servicios. Al configurar las condiciones de activación de la alerta, puede combinar estos campos. Por ejemplo, aveQPS>10 && 2xx ratio<60 indica que, dentro del período estadístico especificado, el QPS del nombre de dominio indicado es mayor que 10 y la proporción de 2xx es menor al 60%.

    • Query Time Range: 5 Minutes (relative)

    • Frequency: Every 5 minutes

    • Trigger Condition: $0.countall > 3000 && $0."4xx Percentage" > 80

    • Notification Trigger Threshold: 2

    • Notification Interval: 10 minutes

    • Send Content:

      - [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].Domain}
- Product: WAF
- Total requests in the last 5 minutes: ${Results[0].RawResults[0].countall}
- 2xx Percentage: ${Results[0].RawResults[0]."2xx Percentage"} %
- 3xx Percentage: ${Results[0].RawResults[0]."3xx Percentage"} %
- 4xx Percentage: ${Results[0].RawResults[0]."4xx Percentage"} %
- 5xx Percentage: ${Results[0].RawResults[0]."5xx Percentage"} %

    Alerta por porcentaje anómalo de 5xx

    Parámetros de alerta recomendados:

    • Chart Name: 5xx Percentage

    • Search Statement:

      user_id:

    • Query Time Range: 5 Minutes (relative)

    • Frequency: Every 5 minutes

    • Trigger Condition: $0.countall > 3000 && $0."5xx Percentage" > 80

    • Notification Trigger Threshold: 2

    • Notification Interval: 10 minutes

    • Send Content:

      - [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].Domain}
- Product: WAF
- Total requests in the last 5 minutes: ${Results[0].RawResults[0].countall}
- 2xx Percentage: ${Results[0].RawResults[0]."2xx Percentage"} %
- 3xx Percentage: ${Results[0].RawResults[0]."3xx Percentage"} %
- 4xx Percentage: ${Results[0].RawResults[0]."4xx Percentage"} %
- 5xx Percentage: ${Results[0].RawResults[0]."5xx Percentage"} %

    Alerta por QPS anómalo

    Parámetros de alerta recomendados:

    • Chart Name: Top 5 QPS

    • Search Statement:

      user_id:

    • Query Time Range: 1 Minute (relative)

    • Frequency: Every 1 minute

    • Trigger Condition: $0.aveQPS >= 50

    • Notification Trigger Threshold: 1

    • Notification Interval: 5 minutes

    • Send Content:

      - [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain name: ${Results[0].RawResults[0].host}
- Product: WAF
- Average QPS in the last minute: ${Results[0].RawResults[0].aveQPS}
- 2xx status code rate: ${Results[0].RawResults[0].Rate_2XX}%
- 3xx status code rate: ${Results[0].RawResults[0].Rate_3XX}%
- 4xx status code rate: ${Results[0].RawResults[0].Rate_4XX}%
- 5xx status code rate: ${Results[0].RawResults[0].Rate_5XX}%

    Alerta por aumento repentino de QPS

    Parámetros de alerta recomendados:

    • Chart Name: QPS surge monitoring

    • Search Statement:

      user_id:

    • Query Time Range: 1 Minute (relative)

    • Frequency: Every 1 minute

    • Trigger Condition: $0.now1mqps > 50 && $0.in_ratio > 300

    • Notification Trigger Threshold: 1

    • Notification Interval: 5 minutes

    • Send Content:

      - [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain name: ${Results[0].RawResults[0].host}
- Product: WAF
- Average QPS in the last minute: ${Results[0].RawResults[0].now1mqps}
- QPS surge rate: ${Results[0].RawResults[0].in_ratio}%
- 2xx status code rate: ${Results[0].RawResults[0].Rate_2XX}%
- 3xx status code rate: ${Results[0].RawResults[0].Rate_3XX}%
- 4xx status code rate: ${Results[0].RawResults[0].Rate_4XX}%
- 5xx status code rate: ${Results[0].RawResults[0].Rate_5XX}%

    Alerta por caída de QPS

    • Chart Name: QPS drop monitoring

    • Search Statement:

      user_id:

      Este gráfico contiene campos como now1mqps (QPS promedio en el minuto actual), past1mqps (QPS promedio en el minuto anterior), de_ratio (tasa de disminución de QPS) y host. Puede utilizar estos campos para establecer condiciones de alerta según sea necesario.

    • Query Time Range: 1 Minute (relative)

    • Frequency: Every 1 minute

    • Trigger Condition: $0.now1mqps > 10 && $0.de_ratio > 50

    • Notification Trigger Threshold: 2

    • Notification Interval: 5 minutes

    • Send Content:

      - [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain name: ${Results[0].RawResults[0].host}
- Product: WAF (International)
- Average QPS in the last minute: ${Results[0].RawResults[0].now1mqps}
- QPS drop rate: ${Results[0].RawResults[0].de_ratio}%
- 2xx status code rate: ${Results[0].RawResults[0].Rate_2XX}%
- 3xx status code rate: ${Results[0].RawResults[0].Rate_3XX}%
- 4xx status code rate: ${Results[0].RawResults[0].Rate_4XX}%
- 5xx status code rate: ${Results[0].RawResults[0].Rate_5XX}%

    Alerta por solicitudes bloqueadas por reglas de ACL

    Parámetros de alerta recomendados:

    • Chart Name: Requests blocked by ACL rules

    • Search Statement:

      user_id:

    • Query Time Range: 5 Minutes (relative)

    • Frequency: Every 5 minutes

    • Trigger Condition: $0.totalblock >= 500 && ($0."Requests Blocked by ACL Policies" >= 500)

    • Notification Trigger Threshold: 1

    • Notification Interval: 5 minutes

    • Send Content:

      - [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].host}
- Product: WAF
- Total blocked requests in the last 5 minutes: ${Results[0].RawResults[0].totalblock}
- Requests blocked by ACL policies: ${Results[0].RawResults[0]."Requests Blocked by ACL Policies"}
- Requests blocked by Protection Rules Engine: ${Results[0].RawResults[0]."Requests Blocked by Protection Rules Engine"}
- Requests blocked by HTTP flood protection policies: ${Results[0].RawResults[0]."Requests Blocked by HTTP Flood Protection Policies"}
- Requests blocked by scan protection policies: ${Results[0].RawResults[0]."Requests Blocked by Scan Protection Policies"}

    Alerta por solicitudes bloqueadas por reglas de protección

    Parámetros de alerta recomendados:

    • Chart Name: Requests blocked by Protection Rules Engine

    • Search Statement:

      user_id:

    • Query Time Range: 5 Minutes (relative)

    • Frequency: Every 5 minutes

    • Trigger Condition: $0.totalblock >= 500 && ($0."Requests Blocked by Protection Rules Engine" >= 500)

    • Notification Trigger Threshold: 1

    • Notification Interval: 5 minutes

    • Send Content:

      - [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].host}
- Product: WAF
- Total blocked requests in the last 5 minutes: ${Results[0].RawResults[0].totalblock}
- Requests blocked by ACL policies: ${Results[0].RawResults[0]."Requests Blocked by ACL Policies"}
- Requests blocked by Protection Rules Engine: ${Results[0].RawResults[0]."Requests Blocked by Protection Rules Engine"}
- Requests blocked by HTTP flood protection policies: ${Results[0].RawResults[0]."Requests Blocked by HTTP Flood Protection Policies"}
- Requests blocked by scan protection policies: ${Results[0].RawResults[0]."Requests Blocked by Scan Protection Policies"}

    Alerta por solicitudes bloqueadas por protección contra inundación HTTP

    Parámetros de alerta recomendados:

    • Chart Name: Requests blocked by HTTP flood protection policies

    • Search Statement:

      user_id:

    • Query Time Range: 5 Minutes (relative)

    • Frequency: Every 5 minutes

    • Trigger Condition: $0.totalblock >= 500 && ($0."Requests Blocked by HTTP Flood Protection Policies" >= 500)

    • Notification Trigger Threshold: 1

    • Notification Interval: 5 minutes

    • Send Content: Obligatorio. El contenido que se enviará. El contenido puede ser una variable. Por ejemplo, puede establecer el contenido como ${message}. La variable debe ser una cadena. Si el contenido es una cadena JSON, debe utilizar la función json_parse para convertirla en un objeto JSON. Por ejemplo, json_parse(${message}). Para obtener más información, consulte Funciones JSON y Funciones de cadena.

      - [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].host}
- Product: WAF
- Total blocked requests in the last 5 minutes: ${Results[0].RawResults[0].totalblock}
- Requests blocked by ACL policies: ${Results[0].RawResults[0]."Requests Blocked by ACL Policies"}
- Requests blocked by Protection Rules Engine: ${Results[0].RawResults[0]."Requests Blocked by Protection Rules Engine"}
- Requests blocked by HTTP flood protection policies: ${Results[0].RawResults[0]."Requests Blocked by HTTP Flood Protection Policies"}
- Requests blocked by scan protection policies: ${Results[0].RawResults[0]."Requests Blocked by Scan Protection Policies"}

    Alerta por solicitudes bloqueadas por protección contra escaneos

    Parámetros de alerta recomendados:

    • Chart Name: Requests blocked by scan protection policies

    • Search Statement:

      user_id:

    • Query Time Range: 5 Minutes (relative)

    • Frequency: Every 5 minutes

    • Trigger Condition: $0.totalblock >= 500 && ($0."Requests Blocked by Scan Protection Policies" >= 500)

    • Notification Trigger Threshold: 1

    • Notification Interval: 5 minutes

    • Send Content:

      - [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].host}
- Product: WAF (International)
- Total blocked requests in the last 5 minutes: ${Results[0].RawResults[0].totalblock}
- Requests blocked by ACL policies: ${Results[0].RawResults[0]."Requests Blocked by ACL Policies"}
- Requests blocked by Protection Rules Engine: ${Results[0].RawResults[0]."Requests Blocked by Protection Rules Engine"}
- Requests blocked by HTTP flood protection policies: ${Results[0].RawResults[0]."Requests Blocked by HTTP Flood Protection Policies"}
- Requests blocked by scan protection policies: ${Results[0].RawResults[0]."Requests Blocked by Scan Protection Policies"}

    Alerta por ataques desde una sola IP

    Parámetros de alerta recomendados:

    • Chart Name: Attack volume from a single IP

    • Search Statement:

      user_id:

      El gráfico incluye los campos real_client_ip (dirección IP del ataque), blockNum (que incluye requests blocked by ACL policies, requests blocked by the Protection Rules Engine y requests blocked by HTTP flood protection policies), totalblock (número total de solicitudes bloqueadas) y allRequest (número total de solicitudes). Puede utilizar estos campos para establecer condiciones de alerta según sea necesario.

    • Query Time Range: 5 Minutes (relative)

    • Frequency: Every 5 minutes

    • Trigger Condition: $0.totalblock >= 500

    • Notification Trigger Threshold: 1

    • Notification Interval: 5 minutes

    • Send Content:

      - [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Product: WAF
- Top 3 attack IP addresses in the last 5 minutes:
- ${Results[0].RawResults[0].real_client_ip} (${Results[0].RawResults[0].blockNum})
- ${Results[0].RawResults[1].real_client_ip} (${Results[0].RawResults[1].blockNum})
- ${Results[0].RawResults[2].real_client_ip} (${Results[0].RawResults[2].blockNum})

    Alerta por una sola IP que ataca varios dominios

    Parámetros de alerta recomendados:

    • Chart Name: Number of domains attacked by a single IP

    • Search Statement:

      user_id:

      Este gráfico contiene campos como real_client_ip (dirección IP del ataque), totalblock (número total de solicitudes bloqueadas) y domainnum (número de nombres de dominio atacados por la dirección IP). Puede combinar estos campos para configurar las condiciones de activación de la alerta. Por ejemplo, totalblock>500&& domainnum>5 indica que el número total de solicitudes bloqueadas desde una dirección IP es mayor a 500 y la cantidad de nombres de dominio atacados supera los 5 dentro del período de tiempo especificado.

    • Query Time Range: 5 Minutes (relative)

    • Frequency: Every 1 minute

    • Trigger Condition: [INVALID] $0.domainnum >= 10

    • Notification Trigger Threshold: 1

    • Notification Interval: 5 minutes

    • Send Content:

      - [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Product: WAF
- Attack IP Address: [INVALID FIELD: real_client_ip]
- Number of attacked domains: [INVALID FIELD: domainnum]
- Total attack requests in the last 5 minutes: ${Results[0].RawResults[0].totalblock}
- Please handle this issue promptly.

    Alerta por latencia promedio anómala

    Parámetros de alerta recomendados:

    • Chart Name: Average latency monitoring

    • Search Statement:

      user_id:

    • Query Time Range: 5 Minutes (relative)

    • Frequency: Every 5 minutes

    • Trigger Condition: $0.request_time > 1000 && $0.requestnum > 30

    • Notification Trigger Threshold: 2

    • Notification Interval: 10 minutes

    • Send Content:

      - [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].host}
- Product: WAF (International)
- [Trigger Condition]: ${condition}
- Top 3 domains with the longest latency in the last 5 minutes (Unit: ms):
- Host1: ${Results[0].RawResults[0].host} Upstream Latency (ms): ${Results[0].RawResults[0].upstream_time} 
- Host2: ${Results[0].RawResults[1].host} Upstream Latency (ms): ${Results[0].RawResults[1].upstream_time} 
- Host3: ${Results[0].RawResults[2].host} Upstream Latency (ms): ${Results[0].RawResults[2].upstream_time}

    Alerta por caída abrupta de tráfico

    Parámetros de alerta recomendados:

    • Chart Name: Traffic drop monitoring

    • Search Statement:

      user_id:

    • Query Time Range: 1 Minute (relative)

    • Frequency: Every 1 minute

    • Trigger Condition: $0.de_ratio > 50 && $0.now1mqps > 20

    • Notification Trigger Threshold: 1

    • Notification Interval: 5 minutes

    • Send Content:

      - [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Product: WAF
- Average QPS in the last minute: ${Results[0].RawResults[0].now1mqps}
- [Trigger condition (Drop Rate & QPS)]: ${condition}
- QPS drop rate: ${Results[0].RawResults[0].de_ratio}%
- 2xx status code rate: ${Results[0].RawResults[0].Rate_2XX}%
- 3xx status code rate: ${Results[0].RawResults[0].Rate_3XX}%
- 4xx status code rate: ${Results[0].RawResults[0].Rate_4XX}%
- 5xx status code rate: ${Results[0].RawResults[0].Rate_5XX}%