Exemplos de configuração de alertas para logs do WAF - Web Application Firewall: Central de Documentação do Alibaba Cloud

Este tópico apresenta exemplos de configurações de alerta para logs do Web Application Firewall (WAF). Use esses exemplos para adicionar gráficos de monitoramento a um painel de logs do WAF e configure alertas.

Importante

Os parâmetros de configuração de alerta deste tópico aplicam-se ao recurso de alerta original do Log Service. Se você usar o novo recurso de alerta, ainda poderá aproveitar as instruções de consulta e as definições de parâmetros recomendadas. Para mais informações, consulte Início rápido da configuração de alertas.

Alerta para porcentagem anormal de 4xx

Parâmetros de alerta recomendados:

Chart Name: 4xx Percentage (Blocked Requests Ignored)
Search Statement:
```
user_id: 
```
Este gráfico contém os seguintes campos: aveQPS, 2xx ratio, 3xx ratio, 4xx ratio e 5xx ratio. Eles representam, respectivamente, as consultas por segundo (QPS) de um domínio e a proporção de cada tipo de código de status. O campo 4xx ratio exclui os códigos de status 444 e 405 gerados por ataques de flood HTTP e ataques web bloqueados pelo Web Application Firewall (WAF). Isso garante a exibição apenas de alterações de código de status originadas pelos seus próprios serviços. Ao configurar condições de acionamento de alerta, combine esses campos. Por exemplo, aveQPS>10 && 2xx ratio<60 indica que, dentro do período estatístico especificado, o QPS do domínio informado é superior a 10 e a taxa de 2xx é inferior a 60%.
Query Time Range: 5 Minutes (relative)
Frequency: Every 5 minutes
Trigger Condition: $0.countall > 3000 && $0."4xx Percentage" > 80
Notification Trigger Threshold: 2
Notification Interval: 10 minutes

Send Content:

- [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].Domain}
- Product: WAF
- Total requests in the last 5 minutes: ${Results[0].RawResults[0].countall}
- 2xx Percentage: ${Results[0].RawResults[0]."2xx Percentage"} %
- 3xx Percentage: ${Results[0].RawResults[0]."3xx Percentage"} %
- 4xx Percentage: ${Results[0].RawResults[0]."4xx Percentage"} %
- 5xx Percentage: ${Results[0].RawResults[0]."5xx Percentage"} %

Alerta para porcentagem anormal de 5xx

Parâmetros de alerta recomendados:

Chart Name: 5xx Percentage
Search Statement:
```
user_id: 
```
Query Time Range: 5 Minutes (relative)
Frequency: Every 5 minutes
Trigger Condition: $0.countall > 3000 && $0."5xx Percentage" > 80
Notification Trigger Threshold: 2
Notification Interval: 10 minutes

Send Content:

- [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].Domain}
- Product: WAF
- Total requests in the last 5 minutes: ${Results[0].RawResults[0].countall}
- 2xx Percentage: ${Results[0].RawResults[0]."2xx Percentage"} %
- 3xx Percentage: ${Results[0].RawResults[0]."3xx Percentage"} %
- 4xx Percentage: ${Results[0].RawResults[0]."4xx Percentage"} %
- 5xx Percentage: ${Results[0].RawResults[0]."5xx Percentage"} %

Alerta para QPS anormal

Parâmetros de alerta recomendados:

Chart Name: Top 5 QPS
Search Statement:
```
user_id: 
```
Query Time Range: 1 Minute (relative)
Frequency: Every 1 minute
Trigger Condition: $0.aveQPS >= 50
Notification Trigger Threshold: 1
Notification Interval: 5 minutes

Send Content:

- [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain name: ${Results[0].RawResults[0].host}
- Product: WAF
- Average QPS in the last minute: ${Results[0].RawResults[0].aveQPS}
- 2xx status code rate: ${Results[0].RawResults[0].Rate_2XX}%
- 3xx status code rate: ${Results[0].RawResults[0].Rate_3XX}%
- 4xx status code rate: ${Results[0].RawResults[0].Rate_4XX}%
- 5xx status code rate: ${Results[0].RawResults[0].Rate_5XX}%

Alerta para pico de QPS

Parâmetros de alerta recomendados:

Chart Name: QPS surge monitoring
Search Statement:
```
user_id: 
```
Query Time Range: 1 Minute (relative)
Frequency: Every 1 minute
Trigger Condition: $0.now1mqps > 50 && $0.in_ratio > 300
Notification Trigger Threshold: 1
Notification Interval: 5 minutes

Send Content:

- [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain name: ${Results[0].RawResults[0].host}
- Product: WAF
- Average QPS in the last minute: ${Results[0].RawResults[0].now1mqps}
- QPS surge rate: ${Results[0].RawResults[0].in_ratio}%
- 2xx status code rate: ${Results[0].RawResults[0].Rate_2XX}%
- 3xx status code rate: ${Results[0].RawResults[0].Rate_3XX}%
- 4xx status code rate: ${Results[0].RawResults[0].Rate_4XX}%
- 5xx status code rate: ${Results[0].RawResults[0].Rate_5XX}%

Alerta para queda de QPS

Chart Name: QPS drop monitoring
Search Statement:
```
user_id: 
```
Este gráfico inclui campos como now1mqps (QPS médio no minuto atual), past1mqps (QPS médio no minuto anterior), de_ratio (taxa de redução de QPS) e host. Use esses campos para definir condições de alerta conforme necessário.
Query Time Range: 1 Minute (relative)
Frequency: Every 1 minute
Trigger Condition: $0.now1mqps > 10 && $0.de_ratio > 50
Notification Trigger Threshold: 2
Notification Interval: 5 minutes

Send Content:

- [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain name: ${Results[0].RawResults[0].host}
- Product: WAF (International)
- Average QPS in the last minute: ${Results[0].RawResults[0].now1mqps}
- QPS drop rate: ${Results[0].RawResults[0].de_ratio}%
- 2xx status code rate: ${Results[0].RawResults[0].Rate_2XX}%
- 3xx status code rate: ${Results[0].RawResults[0].Rate_3XX}%
- 4xx status code rate: ${Results[0].RawResults[0].Rate_4XX}%
- 5xx status code rate: ${Results[0].RawResults[0].Rate_5XX}%

Alerta para requisições bloqueadas por regras de ACL

Parâmetros de alerta recomendados:

Chart Name: Requests blocked by ACL rules
Search Statement:
```
user_id: 
```
Query Time Range: 5 Minutes (relative)
Frequency: Every 5 minutes
Trigger Condition: $0.totalblock >= 500 && ($0."Requests Blocked by ACL Policies" >= 500)
Notification Trigger Threshold: 1
Notification Interval: 5 minutes

Send Content:

- [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].host}
- Product: WAF
- Total blocked requests in the last 5 minutes: ${Results[0].RawResults[0].totalblock}
- Requests blocked by ACL policies: ${Results[0].RawResults[0]."Requests Blocked by ACL Policies"}
- Requests blocked by Protection Rules Engine: ${Results[0].RawResults[0]."Requests Blocked by Protection Rules Engine"}
- Requests blocked by HTTP flood protection policies: ${Results[0].RawResults[0]."Requests Blocked by HTTP Flood Protection Policies"}
- Requests blocked by scan protection policies: ${Results[0].RawResults[0]."Requests Blocked by Scan Protection Policies"}

Alerta para requisições bloqueadas por regras de proteção

Parâmetros de alerta recomendados:

Chart Name: Requests blocked by Protection Rules Engine
Search Statement:
```
user_id: 
```
Query Time Range: 5 Minutes (relative)
Frequency: Every 5 minutes
Trigger Condition: $0.totalblock >= 500 && ($0."Requests Blocked by Protection Rules Engine" >= 500)
Notification Trigger Threshold: 1
Notification Interval: 5 minutes

Send Content:

- [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].host}
- Product: WAF
- Total blocked requests in the last 5 minutes: ${Results[0].RawResults[0].totalblock}
- Requests blocked by ACL policies: ${Results[0].RawResults[0]."Requests Blocked by ACL Policies"}
- Requests blocked by Protection Rules Engine: ${Results[0].RawResults[0]."Requests Blocked by Protection Rules Engine"}
- Requests blocked by HTTP flood protection policies: ${Results[0].RawResults[0]."Requests Blocked by HTTP Flood Protection Policies"}
- Requests blocked by scan protection policies: ${Results[0].RawResults[0]."Requests Blocked by Scan Protection Policies"}

Alerta para requisições bloqueadas pela proteção contra flood HTTP

Parâmetros de alerta recomendados:

Chart Name: Requests blocked by HTTP flood protection policies
Search Statement:
```
user_id: 
```
Query Time Range: 5 Minutes (relative)
Frequency: Every 5 minutes
Trigger Condition: $0.totalblock >= 500 && ($0."Requests Blocked by HTTP Flood Protection Policies" >= 500)
Notification Trigger Threshold: 1
Notification Interval: 5 minutes

Send Content: Obrigatório. Conteúdo a ser enviado. O conteúdo pode ser uma variável. Por exemplo, defina o conteúdo como ${message}. A variável deve ser uma string. Se o conteúdo for uma string JSON, use a função json_parse para convertê-la em um objeto JSON. Por exemplo, json_parse(${message}). Para mais informações, consulte Funções JSON e Funções de string.

- [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].host}
- Product: WAF
- Total blocked requests in the last 5 minutes: ${Results[0].RawResults[0].totalblock}
- Requests blocked by ACL policies: ${Results[0].RawResults[0]."Requests Blocked by ACL Policies"}
- Requests blocked by Protection Rules Engine: ${Results[0].RawResults[0]."Requests Blocked by Protection Rules Engine"}
- Requests blocked by HTTP flood protection policies: ${Results[0].RawResults[0]."Requests Blocked by HTTP Flood Protection Policies"}
- Requests blocked by scan protection policies: ${Results[0].RawResults[0]."Requests Blocked by Scan Protection Policies"}

Alerta para requisições bloqueadas pela proteção contra varredura

Parâmetros de alerta recomendados:

Chart Name: Requests blocked by scan protection policies
Search Statement:
```
user_id: 
```
Query Time Range: 5 Minutes (relative)
Frequency: Every 5 minutes
Trigger Condition: $0.totalblock >= 500 && ($0."Requests Blocked by Scan Protection Policies" >= 500)
Notification Trigger Threshold: 1
Notification Interval: 5 minutes

Send Content:

- [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].host}
- Product: WAF (International)
- Total blocked requests in the last 5 minutes: ${Results[0].RawResults[0].totalblock}
- Requests blocked by ACL policies: ${Results[0].RawResults[0]."Requests Blocked by ACL Policies"}
- Requests blocked by Protection Rules Engine: ${Results[0].RawResults[0]."Requests Blocked by Protection Rules Engine"}
- Requests blocked by HTTP flood protection policies: ${Results[0].RawResults[0]."Requests Blocked by HTTP Flood Protection Policies"}
- Requests blocked by scan protection policies: ${Results[0].RawResults[0]."Requests Blocked by Scan Protection Policies"}

Alerta para ataques de um único IP

Parâmetros de alerta recomendados:

Chart Name: Attack volume from a single IP
Search Statement:
```
user_id: 
```
O gráfico inclui os campos real_client_ip (endereço IP do ataque), blockNum (incluindo requests blocked by ACL policies, requests blocked by the Protection Rules Engine e requests blocked by HTTP flood protection policies), totalblock (número total de requisições bloqueadas) e allRequest (número total de requisições). Use esses campos para definir condições de alerta conforme necessário.
Query Time Range: 5 Minutes (relative)
Frequency: Every 5 minutes
Trigger Condition: $0.totalblock >= 500
Notification Trigger Threshold: 1
Notification Interval: 5 minutes

Send Content:

- [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Product: WAF
- Top 3 attack IP addresses in the last 5 minutes:
- ${Results[0].RawResults[0].real_client_ip} (${Results[0].RawResults[0].blockNum})
- ${Results[0].RawResults[1].real_client_ip} (${Results[0].RawResults[1].blockNum})
- ${Results[0].RawResults[2].real_client_ip} (${Results[0].RawResults[2].blockNum})

Alerta para um único IP atacando múltiplos domínios

Parâmetros de alerta recomendados:

Chart Name: Number of domains attacked by a single IP
Search Statement:
```
user_id: 
```
Este gráfico contém campos como real_client_ip (endereço IP do ataque), totalblock (número total de requisições bloqueadas) e domainnum (quantidade de domínios atacados pelo endereço IP). Combine esses campos para configurar condições de acionamento de alerta. Por exemplo, totalblock>500&& domainnum>5 indica que o total de requisições bloqueadas de um endereço IP supera 500 e o número de domínios atacados excede 5 dentro do período especificado.
Query Time Range: 5 Minutes (relative)
Frequency: Every 1 minute
Trigger Condition: [INVALID] $0.domainnum >= 10
Notification Trigger Threshold: 1
Notification Interval: 5 minutes

Send Content:

- [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Product: WAF
- Attack IP Address: [INVALID FIELD: real_client_ip]
- Number of attacked domains: [INVALID FIELD: domainnum]
- Total attack requests in the last 5 minutes: ${Results[0].RawResults[0].totalblock}
- Please handle this issue promptly.

Alerta para latência média anormal

Parâmetros de alerta recomendados:

Chart Name: Average latency monitoring
Search Statement:
```
user_id: 
```
Query Time Range: 5 Minutes (relative)
Frequency: Every 5 minutes
Trigger Condition: $0.request_time > 1000 && $0.requestnum > 30
Notification Trigger Threshold: 2
Notification Interval: 10 minutes

Send Content:

- [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Domain: ${Results[0].RawResults[0].host}
- Product: WAF (International)
- [Trigger Condition]: ${condition}
- Top 3 domains with the longest latency in the last 5 minutes (Unit: ms):
- Host1: ${Results[0].RawResults[0].host} Upstream Latency (ms): ${Results[0].RawResults[0].upstream_time} 
- Host2: ${Results[0].RawResults[1].host} Upstream Latency (ms): ${Results[0].RawResults[1].upstream_time} 
- Host3: ${Results[0].RawResults[2].host} Upstream Latency (ms): ${Results[0].RawResults[2].upstream_time}

Alerta para queda abrupta de tráfego

Parâmetros de alerta recomendados:

Chart Name: Traffic drop monitoring
Search Statement:
```
user_id: 
```
Query Time Range: 1 Minute (relative)
Frequency: Every 1 minute
Trigger Condition: $0.de_ratio > 50 && $0.now1mqps > 20
Notification Trigger Threshold: 1
Notification Interval: 5 minutes

Send Content:

- [Time]: ${FireTime}
- [UID]: ${Results[0].RawResults[0].user_id}
- Product: WAF
- Average QPS in the last minute: ${Results[0].RawResults[0].now1mqps}
- [Trigger condition (Drop Rate & QPS)]: ${condition}
- QPS drop rate: ${Results[0].RawResults[0].de_ratio}%
- 2xx status code rate: ${Results[0].RawResults[0].Rate_2XX}%
- 3xx status code rate: ${Results[0].RawResults[0].Rate_3XX}%
- 4xx status code rate: ${Results[0].RawResults[0].Rate_4XX}%
- 5xx status code rate: ${Results[0].RawResults[0].Rate_5XX}%