Enabling Alarm Notifications

Constraints

• Only Cloud mode CNAME access mode (professional and enterprise editions) and dedicated mode support certificate expiration alarm notifications.
• Only Cloud mode CNAME access supports cloud-CNAME domain name access alarms notifications.
• Alarm notifications depend on Simple Message Notification (SMN). You are billed based on your actual usage. For details, see SMN Pricing Details.
• Only one alarm notification of the same type can be configured in an enterprise project.

Prerequisites

• You have connected your website to WAF using Cloud Mode - CNAME or Dedicated Mode.
• You have created a topic on the SMN console and the subscription status is confirmed. For details, see Creating a Topic.
• If you want to configure event notifications, ensure that you have configured protection rules. For details, see Configuring Protection Policies.
• If you want to certificate expiration notifications, ensure that you have associated certificates for protected websites. For details, see Using a Certificate for a Protected Website in WAF.
• If you want to configure protection rule expiration notifications, ensure that you have configured the validity periods for the protection rules. For details, see Configuring Protection Policies.

Enabling Alarm Notifications

1. Log in to the WAF console.
2. Click in the upper left corner and select a region or project.
3. (Optional) If you have enabled the enterprise project function, in the upper part of the navigation pane on the left, select your enterprise project from the Filter by enterprise project drop-down list. Then, WAF will display the related security data in the enterprise project on the page.
4. In the navigation pane on the left, choose Instance Management > Notifications.
5. Click Create, configure notification parameters, and click OK.
   Figure 1 Create Notification
   

   Table 1 Description of notification setting parameters

   Parameter	Description
   Notification Type	Type of the notification. Events: If the number of attacks on your website reaches or exceeds the threshold within a specified period, WAF will send an alarm notification to you. The alarm notification contains logs of attacks that are blocked or logged only. Certificate expired: If the certificate used for your website is about to expire, WAF will send an alarm notification to you. Protection rule expired: If a protection rule is about to expire, WAF will send an alarm notification to you. Currently, alarm notifications can be configured only for CC attack protection rules, precise protection rules, blacklist rules, and whitelist rules.
   Notification Name	Name of the alarm notification.
   Enterprise Project	Enterprise project for which the notification takes effect.
   Notification Topic	The topic for configuring the terminals for receiving alarm notifications. Select an existing topic from the drop-down list or click View Topic and create a topic on the displayed page. CAUTION: Sending notifications using SMN topics may incur fees. For details about the billing, see Billing. If there are no topics, click View Topic and perform the following steps to create a topic: Create a topic. For details, see Creating a Topic. Add one or more subscriptions to the topic. You will need to provide a phone number, email address, function, platform application endpoint, DMS endpoint, or HTTP/HTTPS endpoint for receiving alarm notifications. For details, see Adding a Subscription. Confirm the subscription. After the subscription is added, confirm the subscription. For more details about topics and subscriptions, see Simple Message Notification User Guide.
   Interval (Events)	Alarm threshold. An alarm is sent when the number of attacks reaches the threshold within the specified interval. If you select Events for Notification Type, this parameter is mandatory.
   Event Type (Events)	Event types. By default, all event types are selected. You can customize the event types. If you select Events for Notification Type, this parameter is mandatory.
   Protection Rules (Protection rule expired)	Protection rule type. By default, all protection rule types are selected. You can customize the protection rule types. The options are CC Attack Protection, Precise Protection, and Blacklist and Whitelist. If you select Protection rule expired for Notification Type, this parameter is mandatory.
   Notification Before Expiration (Certificate expiration/Protection rule expired)	Notification before certificate expiration. Select how long before a certificate expires WAF can send notifications. You can select 1 week, 1 month, or 2 months. For example, if you select 1 week, WAF will send you an SMS message or email one week before the certificate expires. This parameter must be configured if you select Certificate expiration or Protection rule expired for Notification Type.
   Interval (Certificate expiration/Protection rule expired)	How often WAF sends certificate expiration notifications to you. You can select Weekly or Daily. This parameter must be configured if you select Certificate expiration or Protection rule expired for Notification Type.
   Description	(Optional) A description of the purposes of the alarm.

6. Click OK.
   • To disable a notification, locate the row containing the notification and click Disable in the Operation column.
   • To delete a notification, locate the row containing the notification and click Delete in the Operation column.
   • To modify a notification, locate the row containing the notification and click Modify in the Operation column.

Example Alarm Notification Email

If you have enabled alarm notifications and configured email alarm notifications, WAF emails you reports of any attacks that occur. Figure 2 shows an alarm notification email.

Figure 2 Alarm notification email

Tutorial Video