- What's New
- Function Overview
- Service Overview
- Billing
-
User Guide
- Enabling EdgeSec
- Site Acceleration
-
Security Protection
- Connecting a Domain Name to EdgeSec
- Dashboard
- Protection Statistics
-
Protection Policy
- Creating a Protection Policy
- Applying a Policy to Your Website
-
Configuring Protection Policies
- Configuration Guidance
- Configuring Basic Protection Rules to Defend Against Common Web Attacks
- Configuring CC Attack Protection Rules to Defend Against CC Attacks
- Configuring a Precise Protection Rule
- Creating a Reference Table to Configure Protection Metrics In Batches
- Configuring IP Address Blacklist and Whitelist Rules to Block Specified IP Addresses
- Configuring a Known Attack Source Rule
- Configuring Geolocation Access Control Rules to Block Requests from Specific Locations
- Configuring Anti-Crawler Rules
- Configuring a Global Whitelist Rule to Ignore False Positives
- Configuring a Data Masking Rule
- Address Group Management
- System Management
- Permissions Management
- Key Operations Recorded by CTS
- Monitoring
- Best Practices
-
API Reference
- Before You Start
- API Overview
- API Calling
-
API
- Protected Domain Name Management
-
HTTP Protection Policy Management
- This API is used to query the protection policy list.
- This API is used to create a protection policy.
- This API is used to query a protection policy.
- This API is used to update a protection policy.
- This API is used to delete a protection policy.
- This API is used to update domain names a policy applies to.
- This API is used to update a protection policy rule.
- EdgeSec HTTP Protection Rule Management - CC
- HTTP Protection Rule Management - Precise Protection
-
HTTP Protection Rule Management - IP Address Blacklist and Whitelist
- This API is used to query IP address blacklist and whitelist rules.
- This API is used to create an IP address blacklist or whitelist rule.
- This API is used to query an IP address blacklist or whitelist rule.
- This API is used to update an IP address blacklist or whitelist rule.
- This API is used to delete a blacklist or whitelist rule.
-
HTTP Protection Rule Management - Geographical Location
- This API is used to query the geolocation access control rules.
- This API is used to create a geolocation access control rule.
- This API is used to query a geolocation access control rule.
- This API is used to update a geolocation access control rule.
- This API is used to delete a geolocation access control rule.
-
HTTP Protection Rule Management - False Alarm Masking
- This API is used to query false alarm masking rules.
- This API is used to add a false alarm masking rule.
- This API is used to query a false alarm masking rule.
- This API is used to update a false alarm masking rule.
- This API is used to delete a false alarm masking rule.
- This API is used to reset a false alarm masking rule.
- HTTP Protection Rule Management - Attack Penalty
- IP Address Group Management
- Security Overview
- Reference Table Management
- DDoS Statistics
- HTTP Statistics
- DDoS Attack Logs
-
Appendix
- Status Code
- Error Codes
-
Troubleshooting
- EdgeSec.00000005 Invalid Parameter
- EdgeSec.00000013 Concurrent Modification Exception
- EdgeSec.00000014 Only Default Enterprise Project Supported (Not support operation in this enterprise project)
- EdgeSec.00000015 Write Operation Not Supported When All Enterprise Projects Are Selected (All enterprise projects do not support the write operation)
- EdgeSec.00000018 Migration of Resources to Non-Default Enterprise Project Not Supported (This version only supports default enterprise project)
- EdgeSec.00000019 Frozen Resources Cannot Be Migrated to or from an Enterprise Project (frozen cannot create eps tag)
- EdgeSec.00000023 Operation Not Supported by the Current Specifications
- EdgeSec.00000025 Invalid Block Time (Invalid block time)
- EdgeSec.00000026 Invalid Whitelist Rule Type (Invalid rule type)
- EdgeSec.00000027 Invalid CC Rule Condition Length (Invalid cc condition length value)
- EdgeSec.00010001 Invalid IAM Service Project (Failed to get IAM projects)
- EdgeSec.00010005 Insufficient WAF Policy Rule Quota
- EdgeSec.00010006 Blacklist and Whitelist Rules of Edge WAF Exceed the Quota
- EdgeSec.00010007 Insufficient IP Address Group Quota of Edge WAF
- EdgeSec.00010008 Insufficient Edge WAF Certificate Quota
- EdgeSec.00030001 Invalid DDoS Overview Parameters (Illegal Elasticsearch Request)
- EdgeSec.00030003 DDoS Overview Query Type Exception (Statistic Type Error)
- EdgeSec.00030002 DDoS Overview Query Type Exception (Search Error)
- EdgeSec.00040007 No Permission To Operate
- EdgeSec.00040013 Insufficient Top-Level Domain Name Quota
- EdgeSec.00040014 Expansion Resource Quota Has Been Used
- WAF.00022002 Resource Already Exists (Domain Already Exists)
- WAF.00014002 Resource Already Exists
- common.01010003 No Purchase Permission
- Obtaining a Project ID
- SDK Reference
-
FAQs
- About the Product
-
About Functions
- How Does EdgeSec Detect SQL Injection, XSS, and PHP Injection Attacks?
- How Do I Obtain the Real IP Address of a Visitor in EdgeSec?
- How Does EdgeSec Block Requests?
- Do I Need to Enable All Ports When Configuring an EdgeSec Whitelist in a Security Group?
- Why Do Cookies Contain the HWEdgeSecSESID or HWEdgeSecSESTIME field?
- Does Edge Security Support Alarm Notifications for Attacks?
- Regions and AZs
- General Reference
Copied.
Web Security Overview
On the Web Security Overview page, you can view the protection logs of all protected websites or instances for a specified time range, including yesterday, today, past 3 days, past 7 days, or past 30 days. On this page, event logs are displayed by different dimensions, including the number of attack types, top 10 attacked domain names, top 10 attack source IP addresses, top 10 attacked URLs, top 10 attack source locations, and top 10 error pages.
Statistics on the Web Security Overview page are updated every minute.
Prerequisites
- A domain name has been added and connected. For details, see Adding a Website to EdgeSec.
- At least one protection rule has been configured for the domain name.
Specification Limitations
On the Web Security Overview page, protection data of a maximum of 30 days can be viewed.
Procedure
- Log in to the management console.
- Click
in the upper left corner of the page and choose Content Delivery & Edge Computing > CDN and Security.
- In the navigation pane on the left, choose Dashboard under Edge Security.
- In the upper part of the page, specify the domain, website, and time period you want to query.
- Domain Names: shows information about website domain names added to the EdgeSec instance in the selected enterprise project. Click View to go to the Website Settings page and view details about domain names of protected websites.
- All protected websites: By default, the information about all websites you add to EdgeSec in all enterprise projects are displayed.
- Query time: You can select Yesterday, Today, Past 3 days, Past 7 days, or Past 30 days.
Figure 1 Setting search criteria
- View how many attacks and pages under each type of attacks.
- Attacks: shows how many times the website are attacked.
NOTE:
An alarm is generated when the number of attacks on a single domain name reaches 100,000 within 5 minutes. You can click Message Center button in the upper right corner of the console and choose My Messages > All Messages to view detailed alarm information on the O&M tab page.
- You can view how many requests are attacked by a certain type of attacks within a certain period of time.
Figure 2 Protection action statistics - Attacks: shows how many times the website are attacked.
- Query security data.
Figure 3 Web security event statistics
Table 1 Web security event statistics parameters Parameter
Description
Event Distribution
Types of attack events.
Click an area in the Event Distribution area to view the type, number, and proportion of an attack.
Top 10 Attacked Domain Names
The ten most attacked domain names and the number of attacks on each domain name.
Click View More to go to the Events page and view more protection data.
Top 10 Attack Source IP Addresses
The ten source IP addresses with the most attacks and the number of attacks from each source IP address.
Click View More to go to the Events page and view more protection data.
Top 10 Attacked URLs
The ten most attacked URLs and the number of attacks on each URL.
Click View More to go to the Events page and view more protection data.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot