Help Center/ Web Application Firewall/ Help Panel/ Tier-2 Help Panel - Dashboard/ Managing Events
Updated on 2025-04-25 GMT+08:00
Share

Managing Events

On the Dashboard page, you can view the protection event logs of all protected websites or of all WAF instances for a specified time range, including yesterday, today, past 3 days, past 7 days, or past 30 days. On this page, event logs are displayed by different dimensions, including the number of requests and attack types, QPS, bandwidth, response code, event distribution, top 5 attacked domain names, top 5 attack source IP addresses, top 5 attacked URLs, top 5 attack source locations, and top 5 error pages.

Related Operations

  • On the Events page, you can view the blocked or logged attack events for the last 30 days.
  • If you authorize WAF to access Log Tank Service (LTS), you can use the WAF logs recorded by LTS for quick and efficient real-time analysis, device O&M management, and analysis of service trends. LTS allows you to transfer logs to an Object Storage Service (OBS) bucket or Data Ingestion Service (DIS) for long-term storage.

Related Operations

Once an attack hits a WAF rule, WAF will respond to the attack immediately according to the protective action (Log only or Block) you configured for the rule and display an event on the Events page.

If you are sure that the event is a false positive, handle it as a false alarm. After an event is handled as a false alarm, WAF stops blocking corresponding type of event. No such type of event will be displayed on the Events page and you will no longer receive alarm notifications accordingly.

Type of Hit Rule

Hit Rule

Handling Method

WAF built-in protection rules
  • Basic Web Protection

    Basic web protection defends against common web attacks, such as SQL injection, XSS attacks, remote buffer overflow attacks, file inclusion, Bash vulnerability exploits, remote command execution, directory traversal, sensitive file access, and command and code injections. Basic web protection also detects web shells and evasion attacks.

  • Feature-based anti-crawler protection

    Feature-based anti-crawler identifies and blocks crawler behavior from search engines, scanners, script tools, and other crawlers.

In the row containing the event, click Handle as False Alarm in the Operation column.

Custom protection rules
  • CC attack prevention rules
  • Precise protection rules
  • Blacklist and whitelist rules
  • Geolocation access control rules
  • Web tamper protection rules
  • JavaScript anti-crawler protection
  • Information leakage prevention rules
  • Data masking rules

Go to the page displaying the hit rule and delete it.

Other

Invalid access requests

NOTE:
If either of the following numbers in an access request exceeds 512, WAF blocks the access request as an invalid request:
  • Number of parameters in a form when form-data is used for POST or PUT requests
  • Number of URI parameters

If the Handle as False Alarm button is grayed out, set a precise protection rule to allow the access request.

Related Operations

Parent Topic: Tier-2 Help Panel - Dashboard