Find the top sources of WAF threats

Console

• An Azion account. To create one, refer to Create an account.
• An application served by a workload, with requests in the last 7 days.
• A firewall that runs a WAF rule set on the requests to your application, in Blocking or Logging mode. To set one up, refer to Create and apply a WAF rule set.
• Access to Azion Console. To sign in, refer to How to access Azion Console.

API

• An Azion account. To create one, refer to Create an account.
• An application served by a workload, with requests in the last 7 days.
• A firewall that runs a WAF rule set on the requests to your application, in Blocking or Logging mode. To set one up, refer to Create and apply a WAF rule set.
• A personal token. To create one, refer to How to manage a personal token.
• curl.

Console

To find the countries in Azion Console:

The bar chart draws one bar per country, with the number of threats WAF blocked from it. The pie shows the share of each country. Both list the 20 countries with the most threats, and both leave out the threats WAF logged without blocking. When WAF blocked no threat in the range, each chart reads No data available.

API

To find the countries with the GraphQL API, send a POST request to https://api.azion.com/v4/metrics/graphql. The query groups the httpMetrics dataset by geolocCountryName and selects three WAF counts for each country.

Replace [TOKEN VALUE] with your personal token, and the begin and end values with the 7 days you want to read:

The API answers 200 with one row per country, at most 10:

Each row holds three counts for one country:

• wafRequestsBlocked: threats WAF blocked.
• wafRequestsThreat: threats WAF logged without blocking.
• wafRequestsAllowed: requests WAF allowed.

The rows run from the highest wafRequestsThreat down. To rank the countries by blocked threats, replace wafRequestsThreat_DESC with wafRequestsBlocked_DESC. A row whose three counts are 0 means WAF reported no request from that country in the range.

For every WAF field of the dataset, refer to Real-Time Metrics GraphQL fields.

Console

To find the attack families in Azion Console:

The chart draws one bar per attack family, with the number of threats WAF blocked in it, for the 10 families with the most. When WAF blocked no threat in the range, the chart reads No data available. For what each family name means, refer to Secure dashboards.

To see which of your hosts received the blocked threats, read WAF Threat Requests by Host on the same dashboard. It draws one line per host, up to 16 hosts.

API

To find the attack families with the GraphQL API, send a POST request to https://api.azion.com/v4/metrics/graphql. The query groups the httpMetrics dataset by wafAttackFamily.

Replace [TOKEN VALUE] with your personal token, and the begin and end values with the 7 days you want to read:

The API answers 200 with one row per attack family, at most 10:

Each row counts, for one family, the threats WAF logged without blocking in wafRequestsThreat and the threats it blocked in wafRequestsBlocked. When WAF identifies no threat in the range, the response holds one row, "wafAttackFamily": "-", with 0 in both counts.

Console

To find the IP addresses in Azion Console:

The chart draws one bar per IP address, with the number of requests from it that WAF identified as threats. It lists the 10 addresses with the most. When WAF identified no threat in the range, the chart reads No data available.

API

To find the IP addresses with the GraphQL API, send a POST request to https://api.azion.com/v4/metrics/graphql. The query sums wafThreatRequests from the httpBreakdownMetrics dataset, grouped by remoteAddress. The wafThreatRequestsGt: 0 filter keeps only the addresses that sent threats.

Replace [TOKEN VALUE] with your personal token, and the begin and end values with the 7 days you want to read:

The API answers 200 with one row per address, at most 10:

Each row holds one address in remoteAddress and its threat requests in sum, from the highest down. An empty array means that no address sent a request WAF identified as a threat in the range. Keep the wafThreatRequestsGt: 0 filter: without it, the query also returns the busiest addresses with a sum of 0.

For every field of the dataset, refer to Real-Time Metrics GraphQL fields.