Updated on 2026-09-01 GMT+08:00

Downloading Events

You can download protection events, including automatically generated protection events and manually exported protection events.

Automatically generated events: By default, WAF generates event data for the last five days. One or more CSV files containing the event data of the current day will be generated at the beginning of the next day.
Manually exported events: Click Export above the event list to export the events. Only the first 200 events can be exported.

Each file can include a maximum of 5,000 events. If there are more than 5,000 events, another file is generated.
By default, the WAF console shows event data for the last five days.

Log in to the WAF console.
Click in the upper left corner and select a region or project.
(Optional) If you have enabled the enterprise project function, in the upper part of the navigation pane on the left, select your enterprise project from the Filter by enterprise project drop-down list. Then, WAF will display the related security data in the enterprise project on the page.
In the navigation pane on the left, choose Security Operations > Events.

On the Downloads tab, click Download in the Operation column of the target protection event file to download the protection data file.

Table 1 describes the parameters in the protection event data list.

**Table 1** Parameter description
Parameter	Description
File Name	Data name of the protection event. The format is File name.csv.
File Source	Data source of the protection event.
Number of Events	Total number of events, including blocked and logged-only events. NOTE: Each file can include a maximum of 5,000 events. If there are more than 5,000 events, another file is generated.
Generated	Time the protection event data was generated.

After the download is complete, you can obtain the downloaded file in the download list of the browser and check the events in the file.

Field	Description	Example Value
action	Protective action taken in response to the event	Block
attack	Attack type	SQL Injection
body	Request content of the attack	N/A
cookie	Cookie of the attacker	N/A
headers	Header of the attacker	N/A
Host	Domain name or IP address of the protected website	www.example.com
id	ID of the event.	02-11-16-20201121060347-feb42002
payload	The part of the attack that causes damage to the protected website	python-requests/2.20.1
payload_location	The location of the attack that causes damage or the number of times that the URL is accessed by the attacker	user-agent
policyid	Policy ID.	d5580c8f6cd4403ebbf85892d4bbb8e4
request_line	Request line of the attack.	GET /
rule	ID of the rule against which the event is generated.	81066
sip	Public IP address of the web visitor/attacker.	N/A
time	When the event occurred.	2020/11/21 0:20:44
url	URL of the protected domain name.	N/A

Using LTS to Record WAF Logs: You can enable LTS in WAF for long-term log storage. In LTS, you can view attack and access log details.