WAF接入

WAF访问日志

{"response_code":"504","scheme":"http","upstream_addr":"100.93.2.229:80","body_bytes_sent":"163","upstream_header_time":"-","connection_requests":"1","ssl_cipher":"","hostid":"1736cc7331b74b198e2ef07555a970ce","pid":"2152","tls_version":"","http_host":"www.testh.com","process_time":"0","access_stream_id":"88003425-d7bc-46ce-8ae7-77a8aa18a814","time_iso8601":"2022-07-29T19:39:10+08:00","intel_crawler":"","upstream_status":"504","remote_ip":"10.63.46.110","request_time":"30.008","tenantid":"1d26cc8c86a840e28a4f8d0d07852f1d","sip":"10.63.46.110","bytes_send":"420","projectid":"2a473356cca5487f8373be891bffc1cf","user_agent":"curl/7.29.0","web_tag":"","method":"GET","bind_ip":"10.63.36.208","region_id":"","remote_port":"20582","ssl_ciphers_md5":"","x_real_ip":"","url":"/","x_forwarded_for":"","sni":"","args":"public/../style/general.css=true","cdn_src_ip":"","enterprise_project_id":"0","upstream_connect_time":"-","engine_id":"","request_length":"110","group_id":"5d574e6a-87da-42bc-bfd4-ff61a1b336a4","requestid":"36f0a9212b14528ffc090f1811cd87d8","ssl_curves":"","ssl_session_reused":"","waf-time":"2022-07-29T11:39:10.000Z","upstream_response_time":"30.008","time":"29/Jul/2022:19:39:10 +0800","category":"access","eng_ip":"10.63.36.208"}

response_code

504

源站返回给WAF的响应状态码。

string

scheme

http

请求所使用的协议有：

• http
• https

string

upstream_addr

100.93.2.229:80

选择的后端服务器地址。例如，WAF回源到ECS，则返回源站ECS的IP。

string

body_bytes_sent

163

发送给客户端的响应体字节数

string

upstream_header_time

-

后端服务器接收到第一个响应头字节的用时

string

connection_requests

1

连接请求

string

ssl_cipher

-

SSL密码

string

hostid

1736cc7331b74b198e2ef07555a970ce

访问请求的域名标识

string

pid

2152

进程ID

string

tls_version

-

建立SSL连接的协议版本

string

http_host

www.testh.com

请求的服务器域名

string

process_time

0

引擎的检测用时

string

access_stream_id

88003425-d7bc-46ce-8ae7-77a8aa18a814

日志流ID

string

time_iso8601

2022-07-29T19:39:10+08:00

日志的ISO 8601格式时间

string

intel_crawler

-

爬虫

string

upstream_status

504

后端服务器的响应码

string

remote_ip

10.63.46.110

请求的客户端IP

string

request_time

30.008

请求处理时间

string

tenantid

1d26cc8c86a840e28a4f8d0d07852f1d

防护域名的租户ID

string

sip

10.63.46.110

客户端请求IP

string

bytes_send

420

发送给客户端的总字节数

string

projectid

2a473356cca5487f8373be891bffc1cf

防护域名的项目ID

string

user_agent

curl/7.29.0

请求header中的 user-agent

string

web_tag

-

网站名称

string

method

GET

请求方法

string

bind_ip

10.63.36.208

WAF引擎回源IP

string

region_id

-

请求所属区域

string

remote_port

20582

远程端口

string

ssl_ciphers_md5

-

ssl_ciphers 的 md5 值

string

x_real_ip

-

当WAF前部署代理时，真实的客户端IP

string

url

/

请求URL

string

x_forwarded_for

-

请求头中x_forwarded_for的内容

string

sni

-

通过SNI请求的域名

string

args

public/../style/general.css=true

URL 中的参数数据

string

cdn_src_ip

-

当WAF前部署CDN时CDN识别到的客户端IP

string

enterprise_project_id

0

请求域名所属企业项目ID

string

upstream_connect_time

-

后端服务器连接用时

string

engine_id

-

WAF引擎标识

string

request_length

110

请求的长度

string

group_id

5d574e6a-87da-42bc-bfd4-ff61a1b336a4

对接LTS服务的日志组ID

string

requestid

36f0a9212b14528ffc090f1811cd87d8

随机ID标识

string

ssl_curves

-

客户端支持的曲线列表

string

ssl_session_reused

-

SSL会话是否被重用

string

waf-time

2022-07-29T11:39:10.000Z

WAF日志时间

string

upstream_response_time

30.008

后端服务器响应时间

string

time

29/Jul/2022:19:39:10 +0800

访问请求的时间

string

waf_category

access

WAF日志类别

string

eng_ip

10.63.36.208

WAF引擎IP

string

WAF攻击日志

{"policy_id":"cd081ba3d6674000acc37d7e2a4b9140","hport":"80","body_bytes_sent":"163","hostid":"1736cc7331b74b198e2ef07555a970ce","rule":"040002","engine_ip":"10.63.36.208","pid":"2152","http_host":"www.testh.com","process_time":"1","reqid":"0000-0000-0000-20820220729193940-f34cf25e","time_iso8601":"2022-07-29T19:39:40+08:00","upstream_status":"504","hit_data":"public/../style/general.css","attack_stream_id":"98de5d5a-9f54-4d01-9882-eca7bec99d09","remote_ip":"10.63.46.110","attack":"lfi","tenantid":"1d26cc8c86a840e28a4f8d0d07852f1d","host":"www.testh.com","action":"log","backend":{"protocol":"HTTP","alive":true,"port":80,"host":"100.93.2.229","weight":1,"type":"ip"},"id":"04-0000-0000-0000-20820220729193940-f34cf25e","sip":"10.63.46.110","projectid":"2a473356cca5487f8373be891bffc1cf","web_tag":"","attack-time":"2022-07-29T11:39:40.000Z","method":"GET","cookie":"{\"HWWAFSESTIME\":\"1659094780939\",\"HWWAFSESID\":\"e2cd0733b4712e4cc4\"}","level":2,"params":"{\"public\/..\/style\/general.css\":\"true\"}","x_real_ip":"","uri":"/","x_forwarded_for":"","cdn_src_ip":"","enterprise_project_id":"0","req_body":"","engine_id":"","group_id":"5d574e6a-87da-42bc-bfd4-ff61a1b336a4","requestid":"f34cf25eb33ed82cd7261a8276a60c39","multipart":"null","header":"{\"host\":\"www.testh.com\",\"user-agent\":\"curl\/7.29.0\",\"accept\":\"*\/*\"}","location":"params","upstream_response_time":"30.000","time":"2022-07-29 19:39:40","category":"attack","sport":28408,"status":"504"}

policy_id

cd081ba3d6674000acc37d7e2a4b9140

防护策略ID

string

hport

80

请求的服务器端口

string

body_bytes_sent

163

发送给客户端的响应体字节数

string

hostid

1736cc7331b74b198e2ef07555a970ce

防护域名ID（upstream_id）

string

rule

040002

触发的规则ID或者自定义的策略类型描述

string

engine_ip

10.63.36.208

引擎 IP

string

pid

2152

进程ID

string

http_host

www.testh.com

请求的服务器域名

string

process_time

1

引擎的检测用时

string

reqid

0000-0000-0000-20820220729193940-f34cf25e

随机ID标识

string

time_iso8601

2022-07-29T19:39:40+08:00

日志的ISO 8601格式时间

string

upstream_status

504

后端服务器的响应码

string

hit_data

public/../style/general.css

触发恶意负载的字符串

string

attack_stream_id

98de5d5a-9f54-4d01-9882-eca7bec99d09

日志流ID

string

remote_ip

10.63.46.110

请求的客户端IP

string

attack

lfi

发生攻击的类型，仅在攻击日志中出现。

• default：默认
• sqli：SQL注入攻击
• xss：跨站脚本攻击
• webshell：WebShell攻击
• robot：恶意爬虫
• cmdi：命令注入攻击
• rfi：远程文件包含
• lfi： 本地文件包含
• illegal：非法请求
• vuln：漏洞攻击
• cc：命中CC防护规则
• custom_custom：命中精准防护规则
• custom_whiteip：命中IP黑白名单规则
• custom_geoip：命中地理位置控制规则
• antitamper： 命中网页防篡改规则
• anticrawler：命中JS挑战反爬虫规则
• leakage：命中敏感信息泄露规则
• followed_action：攻击惩罚，详见配置攻击惩罚标准。

string

tenantid

1d26cc8c86a840e28a4f8d0d07852f1d

防护域名的租户ID

string

host

www.testh.com

请求的服务器域名

string

action

log

WAF防护攻击动作。

• block：拦截
• log：仅记录
• captcha：人机验证

string

backend.protocol

HTTP

当前后端协议

string

backend.alive

true

当前后端状态

string

backend.port

80

当前后端端口

long

backend.host

100.93.2.229

当前后端Host值

string

backend.weight

1

当前后端权重

long

backend.type

ip

当前后端Host类型

string

id

04-0000-0000-0000-20820220729193940-f34cf25e

请求ID标识

string

sip

10.63.46.110

请求的客户端IP

string

projectid

2a473356cca5487f8373be891bffc1cf

防护域名的项目ID

string

web_tag

-

网站名称

string

attack-time

2022-07-29T11:39:40.000Z

攻击时间

string

method

GET

请求方法

string

cookie

{"HWWAFSESTIME":"1659094780939","HWWAFSESID":"e2cd0733b4712e4cc4"}

Cookie内容

string

level

2

表示Web基础防护策略级别。

• 1：宽松
• 2：中等
• 3：严格

long

params

{"public\/..\/style\/general.css":"true"}

请求URI后的参数信息

string

x_real_ip

-

当WAF前部署代理时，真实的客户端IP

string

uri

/

请求URI

string

x_forwarded_for

-

请求头中x_forwarded_for的内容

string

cdn_src_ip

-

当WAF前部署CDN时CDN识别到的客户端IP

string

enterprise_project_id

0

请求域名所属企业项目ID

string

req_body

-

请求体

string

engine_id

-

WAF引擎标识

string

group_id

5d574e6a-87da-42bc-bfd4-ff61a1b336a4

group_id

string

requestid

f34cf25eb33ed82cd7261a8276a60c39

随机ID标识

string

multipart

null

multipart

string

header

{"host":"www.testh.com","user-agent":"curl\/7.29.0","accept":"*\/*"}

请求header信息

string

location

params

触发恶意负载的位置

string

upstream_response_time

30.000

后端服务器响应时间

string

time

2022-07-29 19:39:40

日志时间

string

waf_category

attack

WAF日志类别

string

sport

28408

客户端请求端口

long

status

504

请求的响应状态码

string