Viewing Web Protection Events

Prerequisites

A protected website has been added. For details, see Adding a Website to EdgeSec.

Procedure

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Content Delivery & Edge Computing > CDN and Security.
3. In the navigation pane on the left, choose Edge Security > Statistic. The Statistic page is displayed.
4. Select a website from the Website drop-down list. You can view protection logs of yesterday, today, past 3 days, past 7 days, past 30 days, or a user-defined time range.
   Figure 1 Events
   

5. View the event details.
   • In the search box, select a property or enter a keyword. For details about the search conditions, see Table 1.
   • Click to select fields you want to display in the event lists.
   • To view event details, locate the row containing the event and click Details in the Operation column.

   Table 1 Description of the conditions

   Parameter	Description
   Event ID	ID of the event
   Incident Type	Type of the attack. By default, All is selected. You can view logs of all attack types or select an attack type to view corresponding attack logs.
   Protective Action	The options are Block, Log only, and Verification code.
   Source IP	Public IP address of the web visitor/attacker By default, All is selected. You can view logs of all attack source IP addresses, select an attack source IP address, or enter an attack source IP address to view corresponding attack logs.
   URL	Attacked URL
   Rule ID	Protection rule ID
   Geolocation	Geographical location from which an IP address is originated
   Attack Type	Web application attack Access control Challenge Collapsar (CC) attack Bot attack
   ASN	Autonomous system number

   Table 2 Parameters in the event list

   Parameter	Description	Example Value
   Rule Name	The name is displayed only when a user-created rule is matched. For default rules, such as the built-in rules for basic web protection and bot protection, the rule names are not displayed.	cc
   Time	When the attack occurred	2023/03/04 13:20:04
   Source IP Address	Public IP address of the web visitor/attacker	xx.xx.10.1
   Domain Name	Attacked domain name	www.example.com
   Geolocation	Location where the IP address of the attack originates from	United States
   URL	Attacked URL	/admin
   Incident Type	Type of the attack.	Precise Defense
   Protective Action	The options are Block, Log only, and Verification code. NOTE: If an access request matches a data masking rule, the protective action is marked as Mismatch.	Block
   ASN	Autonomous system number	20115