Help Center/ Log Tank Service/ User Guide/ Log Visualization/ Visualizing Logs in Dashboards/ Dashboard Templates (Pipe Character)/ WAF Dashboard Templates
Updated on 2026-09-18 GMT+08:00
View PDF
Share

WAF Dashboard Templates

WAF keeps web services stable and secure. It examines all HTTP and HTTPS requests to detect and block the following attacks: Structured Query Language (SQL) injection, cross-site scripting (XSS), web shells, command and code injections, file inclusion, sensitive file access, third-party vulnerability exploits, Challenge Collapsar (CC) attacks, malicious crawlers, and cross-site request forgery (CSRF).

WAF dashboard templates support Viewing WAF Security Log Center and Viewing WAF Access Log Center.

Prerequisites

Viewing WAF Security Log Center

  1. Log in to the LTS console.
  2. In the navigation pane, choose Dashboards.
  3. Choose WAF Dashboard Templates under Dashboard Templates and click WAF Security Log Center to view the detailed charts.

    Figure 1 WAF Security Log Center
    • CC Attacks Intercepted. The associated query and analysis statement is: 
      * | SELECT
   CASE

   WHEN
   diff [ 1 ] < 1000 THEN
   concat (cast (cast (diff [ 1 ] as DECIMAL (20,2)) AS VARCHAR), '')
   WHEN diff [ 1 ] < 1000 * 1000 THEN
   concat( cast(cast( diff [ 1 ]/ 1000 as DECIMAL(20,2)) AS VARCHAR ), ' thousand' ) 
   WHEN diff [ 1 ] < 1000000000 THEN
   concat( cast( cast( diff [ 1 ]/ 1000000.0 as DECIMAL(20,2)) AS VARCHAR ), ' million' ) 
   WHEN diff [ 1 ]/ 1000.0 < 1000000000 THEN
   concat( cast( cast( diff [ 1 ]/ 1000.0 / 1000000 as DECIMAL(20,2)) AS VARCHAR ), ' billion' ) ELSE concat( cast ( cast( diff [ 1 ]/ 1000.0 / 1000 / 1000 / 1000 as DECIMAL(20,2)) AS VARCHAR ), ' trillion' ) 
   END AS 
   "value"
   ,
   CASE WHEN diff [ 2 ]= 0 THEN 0 ELSE round( diff [ 3 ]- 1, 2 ) END AS ratio 
   FROM
   ( SELECT compare ( "data", 86400 ) AS diff FROM ( SELECT count( 1 ) AS "data" FROM log WHERE attack != 'default') )
    • Attack Traffic Peak. The associated query and analysis statement is: 
      * | SELECT   diff [ 1 ] AS "VALUE",    CASE WHEN diff [ 2 ]= 0 THEN 0 ELSE round( diff [ 3 ]- 1, 2 ) END AS ratio    FROM    (    SELECT    compare ( "DATA" , 86400 ) AS diff    FROM    (    SELECT COALESCE    ( max( pv ), 0 ) AS "DATA"    FROM    ( SELECT from_unixtime(__time - __time%60000) AS dt, CEIL(count(1)/ 60.0) AS pv FROM log    WHERE action != ''    GROUP BY dt LIMIT 10000 )))
    • Originating Countries. The associated query and analysis statement is: 
      * | SELECT
   diff [ 1 ] AS 
   "VALUE"
   ,
   COALESCE ( diff [ 1 ]- diff [ 2 ], 0 ) AS "BEFORE" 
   FROM
   (
   SELECT
   compare ( "DATA", 86400 ) AS diff 
   FROM
   ( SELECT count( DISTINCT ip_to_country ( CASE WHEN sip = '-' THEN remote_ip ELSE sip END) ) AS "DATA" FROM log 
   WHERE action != ''
   ) 
   )
    • Web Attacks Intercepted. The associated query and analysis statement is: 
      * | SELECT
   CASE

   WHEN
   diff [ 1 ] < 1000 THEN
   concat (cast (cast (diff [ 1 ] as DECIMAL (20,2)) AS VARCHAR), '')
   WHEN diff [ 1 ] < 1000 * 1000 THEN
   concat( cast( cast( diff [ 1 ]/ 1000 as DECIMAL(20,2)) AS VARCHAR ), ' thousand' ) 
   WHEN diff [ 1 ] < 1000000000 THEN
   concat( cast( cast( diff [ 1 ]/ 1000000.0 as DECIMAL(20,2)) AS VARCHAR ), ' million' ) 
   WHEN diff [ 1 ]/ 1000.0 < 1000000000 THEN
   concat( cast( cast( diff [ 1 ]/ 1000.0 / 1000000 as DECIMAL(20,2)) AS VARCHAR ), ' billion' ) ELSE concat( cast( cast( diff [ 1 ]/ 1000.0 / 1000 / 1000 / 1000 as DECIMAL(20,2)) AS VARCHAR ), ' trillion' ) 
   END AS 
   "value"
   ,
   CASE WHEN diff [ 2 ]= 0 THEN 0 ELSE round( diff [ 3 ]- 1, 2 ) END AS ratio 
   FROM
   ( SELECT compare ( "data", 86400 ) AS diff FROM ( SELECT count( 1 ) AS "data" FROM log WHERE action != '' ) )
    • Attacker UV. The associated query and analysis statement is: 
      * | SELECT
   CASE
   WHEN
   diff [ 1 ] < 1000 THEN
   concat( cast( cast ( diff [ 1 ] AS INTEGER ) AS VARCHAR ), '' ) 
   WHEN diff [ 1 ] < 1000 * 1000 THEN
   concat( cast( cast( diff [ 1 ]/ 1000 as DECIMAL(20,2)) AS VARCHAR ), ' thousand' ) 
   WHEN diff [ 1 ] < 1000000000 THEN
   concat( cast( cast( diff [ 1 ]/ 1000000.0 as DECIMAL(20,2)) AS VARCHAR ), ' million' ) 
   WHEN diff [ 1 ]/ 1000.0 < 1000000000 THEN
   concat( cast( cast(diff [ 1 ]/ 1000.0 / 1000000 as DECIMAL(20,2)) AS VARCHAR ), ' billion' ) ELSE concat( cast( cast( diff [ 1 ]/ 1000.0 / 1000 / 1000 / 1000 as DECIMAL(20,2)) AS VARCHAR ), ' trillion' ) 
   END AS "value",
   CASE WHEN diff [ 2 ]= 0 THEN 0 ELSE round( diff [ 3 ]- 1, 2 ) END AS ratio 
   FROM
   (
   SELECT
   compare ( "data", 86400 ) AS diff 
   FROM
   ( SELECT count( DISTINCT CASE WHEN sip = '-' THEN remote_ip ELSE sip END ) AS "data" 
   FROM log
   ))
    • Total Attacks Intercepted. The associated query and analysis statement is: 
      * | SELECT
   CASE
   WHEN
   diff [ 1 ] < 1000 THEN
   concat( cast(cast( diff [ 1 ] as DECIMAL(20,2)) AS VARCHAR ), ' ' ) 
   WHEN diff [ 1 ] < 1000 * 1000 THEN
   concat( cast( cast( diff [ 1 ]/ 1000 as DECIMAL(20,2)) AS VARCHAR ), ' thousand' ) 
   WHEN diff [ 1 ] < 1000000000 THEN
   concat( cast( cast( diff [ 1 ]/ 1000000.0 as DECIMAL(20,2)) AS VARCHAR ), ' million' ) 
   WHEN diff [ 1 ]/ 1000.0 < 1000000000 THEN
   concat( cast( cast( diff [ 1 ]/ 1000.0 / 1000000 as DECIMAL(20,2)) AS VARCHAR ), ' billion' ) ELSE concat( cast( cast( diff [ 1 ]/ 1000.0 / 1000 / 1000 / 1000 as DECIMAL(20,2)) AS VARCHAR ), ' trillion' ) 
   END AS 
   "value",
   CASE WHEN diff [ 2 ]= 0 THEN 0 ELSE round( diff [ 3 ]- 1, 2 ) END AS "ratio" 
   FROM
   (
   SELECT
   compare ( "data", 86400 ) AS diff 
   FROM
   ( SELECT count( 1 ) AS "data" FROM log WHERE action != '') 
   )
    • CC Attacks. The associated query and analysis statement is: 
      * | SELECT
   ip_to_province (
   CASE WHEN sip = '-' THEN remote_ip ELSE sip END) AS province,
   count( 1 ) AS " attacks" 
   WHERE attack != 'default'
   GROUP BY
   province
    • Web Attacks. The associated query and analysis statement is: 
      * | SELECT
   ip_to_province (
   CASE WHEN sip = '-' THEN remote_ip ELSE sip END) AS province,
   count( 1 ) AS " attacks" 
   WHERE action = 'block'
   GROUP BY
   province
    • Attack Types. The associated query and analysis statement is: 
      * | SELECT time_format(from_unixtime(__time - __time%60000),'yyyy-MM-dd HH:mm:ss','+08:00') AS dt, count( 1 ) AS cnt, CASE  WHEN action = 'block' THEN 'Block'  WHEN action = 'log' THEN 'Log only'  WHEN action = 'captcha' THEN 'Human-machine verification' END AS attack FROM log WHERE action != '' GROUP BY dt, attack ORDER BY dt
    • CC Attacks (Global). The associated query and analysis statement is: 
       * | SELECT
   ip_to_country (CASE WHEN sip = '-' THEN remote_ip ELSE sip END) AS country,
   count( 1 ) AS " attacks" 
   WHERE attack != 'default'
   GROUP BY
   country
    • Web Attacks (Global). The associated query and analysis statement is: 
       * | SELECT
   ip_to_country (CASE WHEN sip = '-' THEN remote_ip ELSE sip END) AS country,
   count( 1 ) AS " attacks" 
   WHERE action = 'block'
   GROUP BY
   country

Viewing WAF Access Log Center

  1. Choose WAF Dashboard Templates under Dashboard Templates and click WAF Access Log Center to view the detailed charts.

    Figure 2 WAF Access Log Center
    • PV. The associated query and analysis statement is: 
      * | SELECT       CASE               WHEN       diff [ 1 ] < 1000 THEN       concat( cast( cast(diff [ 1 ] AS DECIMAL(20,2)) AS VARCHAR ), '' )        WHEN diff [ 1 ] < 1000 * 1000 THEN       concat( cast(cast( diff [ 1 ]/ 1000 AS DECIMAL(20,2)) AS VARCHAR ), ' thousand' )        WHEN diff [ 1 ] < 1000000000 THEN       concat( cast(cast(  diff [ 1 ]/ 1000000.0 AS DECIMAL(20,2)) AS VARCHAR ), ' million' )        WHEN diff [ 1 ]/ 1000.0 < 1000000000 THEN       concat( cast(cast( diff [ 1 ]/ 1000 / 1000000.0 AS DECIMAL(20,2)) AS VARCHAR ), ' billion' ) ELSE concat( cast(cast(  diff [ 1 ]/ 1000.0 / 1000 / 1000 / 1000 AS DECIMAL(20,2)) AS VARCHAR ), ' trillion' )        END AS        "VALUE"       ,       CASE WHEN diff [ 2 ]= 0 THEN 0 ELSE round(diff [ 3 ]- 1,2) END AS ratio        FROM       (       SELECT       compare ( DATA, 86400 ) AS diff        FROM       ( SELECT count( 1 ) AS DATA FROM log )        )
    • UV. The associated query and analysis statement is: 
      * | SELECT       CASE               WHEN       diff [ 1 ] < 1000 THEN       concat( cast( cast( diff [ 1 ] AS DECIMAL(20,2)) AS VARCHAR ), '' )        WHEN diff [ 1 ] < 1000 * 1000 THEN       concat( cast( cast( diff [ 1 ]/ 1000 AS DECIMAL(20,2)) AS VARCHAR ), ' thousand' )        WHEN diff [ 1 ] < 1000000000 THEN       concat( cast( cast( diff [ 1 ]/ 1000000.0 AS DECIMAL(20,2)) AS VARCHAR ), ' million' )        WHEN diff [ 1 ]/ 1000.0 < 1000000000 THEN       concat( cast( cast( diff [ 1 ]/ 1000 / 1000000.0 AS DECIMAL(20,2)) AS VARCHAR ), ' billion' ) ELSE concat( cast( cast(  diff [ 1 ]/ 1000.0 / 1000 / 1000 / 1000 AS DECIMAL(20,2)) AS VARCHAR ), ' trillion' )        END AS        "VALUE"       ,       CASE               WHEN diff [ 2 ]= 0 THEN       0 ELSE round( diff [ 3 ]- 1, 2 )       END AS ratio        FROM       (       SELECT       compare ( DATA, 86400 ) AS diff        FROM       ( SELECT count( DISTINCT CASE WHEN sip = '-' THEN remote_ip ELSE sip END ) AS "DATA" FROM log )        )
    • Incoming Traffic. The associated query and analysis statement is: 
      * | SELECT       CASE               WHEN       diff [ 1 ] < 102 THEN       concat( cast( cast( diff [ 1 ] AS DECIMAL(20,2)) AS VARCHAR ), ' B' )        WHEN diff [ 1 ] < 1024 * 1024 THEN       concat( cast( cast( diff [ 1 ]/ 1024 AS DECIMAL(20,2)) AS VARCHAR ), ' KB' )        WHEN diff [ 1 ] < 1024 * 1024 * 1024 THEN       concat( cast( cast( diff [ 1 ]/ 1024.0 / 1024 AS DECIMAL(20,2)) AS VARCHAR ), ' MB' )        WHEN diff [ 1 ]/ 1024.0 < 1024 * 1024 * 1024 THEN       concat( cast( cast( diff [ 1 ]/ 1024.0 / 1024 / 1024 AS DECIMAL(20,2)) AS VARCHAR ), ' GB' ) ELSE concat( cast( cast( diff [ 1 ]/ 1024.0 / 1024 / 1024 / 1024 AS DECIMAL(20,2)) AS VARCHAR ), ' TB' )        END AS        "VALUE"       ,       CASE               WHEN diff [ 2 ]= 0 THEN       0 ELSE round( diff [ 3 ]- 1, 2 )       END AS ratio        FROM       (       SELECT       compare ( "DATA", 86400 ) AS diff        FROM       ( SELECT COALESCE ( sum( try_cast(request_length as bigint) ), 0 ) AS "DATA" FROM log )        )
    • Peak In-Bandwidth. The associated query and analysis statement is: 
      * | SELECT CASE     WHEN   diff [ 1 ] < 102 THEN    concat( cast( cast(  diff [ 1 ] AS DECIMAL(20,2)) AS VARCHAR ), ' B/s' )     WHEN diff [ 1 ] < 1024 * 1024 THEN    concat( cast( cast(  diff [ 1 ]/ 1024  AS DECIMAL(20,2)) AS VARCHAR ), ' KB/s' )     WHEN diff [ 1 ] < 1024 * 1024 * 1024 THEN    concat( cast( cast( diff [ 1 ]/ 1024.0 / 1024  AS DECIMAL(20,2)) AS VARCHAR ), ' MB/s' )     WHEN diff [ 1 ]/ 1024.0 < 1024 * 1024 * 1024 THEN    concat( cast( cast(  diff [ 1 ]/ 1024.0 / 1024 / 1024  AS DECIMAL(20,2)) AS VARCHAR ), ' GB/s' ) ELSE concat( cast( cast(  diff [ 1 ]/ 1024.0 / 1024 / 1024 / 1024  AS DECIMAL(20,2)) AS VARCHAR ), ' TB/s' )    END AS "VALUE",  CASE        WHEN diff [ 2 ]= 0 THEN    0 ELSE round( diff [ 3 ]- 1, 2 )    END AS ratio   FROM   (   SELECT    compare ( "DATA", 86400 ) AS diff    FROM    (    SELECT COALESCE     ( max( "DATA" ), 0 ) AS "DATA"     FROM     (     SELECT time_format(from_unixtime(__time - __time%60000),'yyyy-MM-dd HH:mm:ss','+08:00') AS dt,      sum( try_cast( request_length AS BIGINT ) )/ 60.0 AS "DATA"      FROM      log      GROUP BY      dt       LIMIT 10000      ))   )
    • Peak Out-Bandwidth. The associated query and analysis statement is: 
      * | SELECT CASE WHEN diff [ 1 ] < 102 THEN concat( cast( cast(  diff [ 1 ] AS DECIMAL(20,2)) AS VARCHAR ), ' B/s' )  WHEN diff [ 1 ] < 1024 * 1024 THEN concat(cast( cast(  diff [ 1 ]/ 1024  AS DECIMAL(20,2)) AS VARCHAR ), ' KB/s' ) WHEN diff [ 1 ] < 1024 * 1024 * 1024 THEN concat( cast( cast(  diff [ 1 ]/ 1024.0 / 1024  AS DECIMAL(20,2)) AS VARCHAR ), ' MB/s' ) WHEN diff [ 1 ]/ 1024.0 < 1024 * 1024 * 1024 THEN concat( cast( cast(  diff [ 1 ]/ 1024.0 / 1024 / 1024 AS DECIMAL(20,2)) AS VARCHAR ), ' GB/s' ) ELSE concat( cast( cast(  diff [ 1 ]/ 1024.0 / 1024 / 1024 / 1024  AS DECIMAL(20,2)) AS VARCHAR ), ' TB/s' ) END AS "value", case when diff [ 2 ]= 0 then 0 else round( diff [ 3 ]- 1, 2 ) END AS "ratio" FROM ( SELECT compare ( "DATA", 86400 ) AS diff FROM ( SELECT COALESCE ( max( bytes_out ), 0 ) AS "DATA" FROM ( SELECT time_format(from_unixtime(__time - __time%60000),'yyyy-MM-dd HH:mm:ss','+08:00') AS dt, sum( try_cast(body_bytes_sent as double precision) )/ 60.0 AS bytes_out FROM log GROUP BY dt LIMIT 10000 )))
    • Traffic Bandwidth Trend. The associated query and analysis statement is: 
      * | SELECT time_format(from_unixtime(__time - __time%600000),'yyyy-MM-dd HH:mm:ss','+08:00') AS dt, round( sum( try_cast( request_length AS double precision ) )/ 1024.0 / 600, 2 ) AS "Incoming (KB/s)", round( sum( try_cast( body_bytes_sent AS double precision ) )/ 1024.0 / 600, 2) AS "Outgoing (KB/s)"  GROUP BY  dt ORDER BY  dt   LIMIT 1000
    • PV/UV Trend. The associated query and analysis statement is: 
      * | SELECT time_format(from_unixtime(__time - __time%3600000),'yyyy-MM-dd HH:mm:ss','+08:00') AS dt, count( 1 ) AS PV, COUNT( DISTINCT ( CASE WHEN sip = '-' THEN remote_ip ELSE sip END )) AS UV  FROM log  GROUP BY  dt  ORDER BY  dt   LIMIT 1000
    • Visit Statuses. The associated query and analysis statement is: 
      * | SELECT time_format(from_unixtime(__time - __time%3600000),'yyyy-MM-dd HH:mm:ss','+08:00') AS dt, count( 1 ) AS cnt, concat( cast( cast("response_code" as BIGINT) / 100 AS VARCHAR ), 'XX' ) AS "status"  GROUP BY  dt,  cast("response_code" as BIGINT) / 100  ORDER BY  dt   LIMIT 10000
    • Access Sources. The associated query and analysis statement is: 
      * | SELECT       ip_to_country (CASE WHEN sip = '-' THEN remote_ip ELSE sip END) AS country,       count( 1 ) AS "Visits"        GROUP BY      country  having   country != ''
    • Incoming Traffic Sources (China). The associated query and analysis statement is: 
      * | SELECT       ip_to_province (CASE WHEN sip = '-' THEN remote_ip ELSE sip END) AS region,       round( sum( try_cast(request_length as double precision) )/ 1024.0 / 1024, 4 ) AS "Incoming (MB)"        GROUP BY region  having    region != ''
    • Incoming Traffic Sources (Global). The associated query and analysis statement is: 
      * | SELECT       ip_to_country (CASE WHEN sip = '-' THEN remote_ip ELSE sip END) AS region,       round( sum( try_cast(request_length as double precision) )/ 1024.0 / 1024, 4 ) AS "Incoming (MB)"        GROUP BY       region having region != ''
    • Source Network Providers. The associated query and analysis statement is: 
      * | SELECT      ip_to_provider (CASE WHEN sip = '-' THEN remote_ip ELSE sip END) AS provider,       cast(round( sum( try_cast(request_length as bigint) )/ 1024.0 / 1024.0, 3 ) AS double precision) AS mb_in       GROUP BY       provider        HAVING       ip_to_provider (CASE WHEN sip = '-' THEN remote_ip ELSE sip END) != '*'        ORDER BY       mb_in DESC        LIMIT 10
    • Domain Names. The associated query and analysis statement is: 
      * | SELECT       http_host,       count( 1 ) AS "Visits"        GROUP BY       http_host        ORDER BY       "Visits" DESC        LIMIT 30
    • URLs with the Slowest Response. The associated query and analysis statement is: 
      * | SELECT http_host AS "Website",url_extract_path (COALESCE ( url, '/' )) AS URL,sum( request_time )/ count( 1 ) AS "Response Duration (ms)",count( 1 ) AS "Visits" GROUP BY http_host, url ORDER BY "Response Duration (ms)" DESC  LIMIT 100
    • Clients with the Most Visits. The associated query and analysis statement is: 
      * | SELECT ip AS "Client", client AS "Network", concat(  cast( ( CASE WHEN pv IS NULL THEN 0 ELSE pv END ) AS VARCHAR ),  ' (',  cast( CASE WHEN head_pv is null THEN 0 ELSE ( CASE WHEN head_pv > 0 THEN head_pv ELSE 0 END ) END AS VARCHAR ),  '/',  cast( CASE WHEN get_pv is null THEN 0 ELSE ( CASE WHEN get_pv > 0 THEN get_pv ELSE 0 END ) END AS VARCHAR ),  '/',  cast( CASE WHEN put_pv is null THEN 0 ELSE ( CASE WHEN put_pv > 0 THEN put_pv ELSE 0 END ) END AS VARCHAR ),  '/',  cast( CASE WHEN post_pv is null THEN 0 ELSE ( CASE WHEN post_pv > 0 THEN post_pv ELSE 0 END ) END AS VARCHAR ),  '/',  cast( CASE WHEN delete_pv is null THEN 0 ELSE ( CASE WHEN delete_pv > 0 THEN delete_pv ELSE 0 END ) END AS VARCHAR ),  '/',  ')'  ) AS "PV (Head, Get, Put, Post, Delete)", error_count AS "Wrong Visits"  FROM  (  SELECT   ip,   client,   sum( CASE WHEN "method" = 'PUT' AND "status" < 400 THEN pv ELSE 0 END ) AS put_pv,   sum( CASE WHEN "method" = 'GET' AND "status" < 400 THEN pv ELSE 0 END ) AS get_pv,   sum( CASE WHEN "method" = 'POST' AND "status" < 400 THEN pv ELSE 0 END ) AS post_pv,   sum( CASE WHEN "method" = 'DELETE' AND "status" < 400 THEN pv ELSE 0 END ) AS delete_pv,   sum( CASE WHEN "method" = 'HEAD' AND "status" < 400 THEN pv ELSE 0 END ) AS head_pv,   sum( throughput ) AS throughput,   sum( pv ) AS pv,   sum( CASE WHEN "status" < 400 THEN 1 ELSE 0 END ) AS error_count   FROM   (   SELECT   CASE         WHEN     sip = '-' THEN      remote_ip ELSE sip       END AS ip,     "method",    CASE            WHEN ip_to_country ( CASE WHEN sip = '-' THEN remote_ip ELSE sip END )= 'Hong Kong' THEN       'Hong Kong, China'        WHEN ip_to_province ( CASE WHEN sip = '-' THEN remote_ip ELSE sip END )= '*' THEN        'Unknown IP'         WHEN ip_to_provider ( CASE WHEN sip = '-' THEN remote_ip ELSE sip END )= 'Private IP' THEN         'Private IP' ELSE concat( ip_to_country ( CASE WHEN sip = '-' THEN remote_ip ELSE sip END ), '/', ip_to_province ( CASE WHEN sip = '-' THEN remote_ip ELSE sip END ), '/',         CASE    WHEN ip_to_city

Parent Topic: Dashboard Templates (Pipe Character)