Viewing Events

Prerequisites

A protected website has been added. For details, see Adding a Website to EdgeSec.

Procedure

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security & Compliance > Edge Security.
3. In the navigation pane on the left, choose Dashboard under Security Protection.
4. In the navigation pane on the left, choose Events.
5. Select a website from the Website drop-down list. You can view protection logs of yesterday, today, past 3 days, past 7 days, past 30 days, or a user-defined time range.
   • Events over Time: Displays the protection status of the selected website within the selected time range.
   • Top Tens: Displays a summary of top tens about protected domain names you select for a time range.
     Figure 1 Events
     

6. In the Events area, view the event details.
   • Configure a filter by combining several conditions. Click Add and select filter conditions displayed. Then, click OK. Table 1 lists parameters for filter conditions.
   • Click to select fields you want to display in the event lists.
   • To view event details, locate the row containing the event and click Details in the Operation column.
   Figure 2 Events
   

   Table 1 Description of the conditions

   Parameter	Description
   Event ID	ID of the event
   Incident Type	Type of the attack. By default, All is selected. You can view logs of all attack types or select an attack type to view corresponding attack logs.
   Rule ID	ID of a built-in protection rule in basic web protection
   Protective Action	The options are Block, Log only, and Verification code.
   Source IP	Public IP address of the web visitor/attacker By default, All is selected. You can view logs of all attack source IP addresses, select an attack source IP address, or enter an attack source IP address to view corresponding attack logs.
   URL	Attacked URL

   Table 2 Parameters in the event list

   Parameter	Description	Example Value
   Time	When the attack occurred	2023/03/04 13:20:04
   Source IP Address	Public IP address of the web visitor/attacker	-
   Domain Name	Attacked domain name	www.example.com
   Geolocation	Location where the IP address of the attack originates from	-
   URL	Attacked URL	/admin
   Incident Type	Type of the attack.	Precise Defense
   Protective Action	The options are Block, Log only, and Verification code. NOTE: If an access request matches a data masking rule, the protective action is marked as Mismatch.	Block