Logs

Viewing Logs 🔗

• Console
• CLI
• API

• 1. Open the navigation menu and click Identity & Security. Under Web Application Firewall, click Policies.

     Alternatively, open the Web Application Firewall page and click Policies under Resources.

     The WAF Policies page appears.

  2. Select the Compartment from the list.

     All the WAF policies in that compartment are listed in tabular form.

  3. (Optional) Apply one or more of the following Filters to limit the WAF policies displayed:

     • Name

     • Policy Type

     • Status

  4. Select the edge policy whose logs you want to view.
     The Edge Policy Details dialog box appears.
  5. Click Logs under Resources.

     The Logs list appears.

  6. (Optional) Complete one or more of the following Filters to limit the log information to the values you enter:

     • Start date

     • Start time

     • End date

     • End time

     • Request URL

     • Client IP address

     • Country name

  7. (Optional) Check one or more of the following Action filters to limit the log information to the selected options:

     • Detect

     • Block

     • Bypass

     • Log

     • Redirected

  8. (Optional) Check one or more of the following Log type filters to limit the log information to the selected options:

     • Access rules

     • CAPTCHA challenge

     • JavaScript challenge

     • Protection rules

     • Human interaction challenge

     • Device fingerprinting challenge

     • Threat intelligence feeds

     • Address rate limiting

     • Access

     Only log information containing the checked actions is displayed.

  9. Click the plus sign next to the Alert Type you want to view.

  Log entries are displayed based on the options you chose.

• This task can't be performed using the CLI.

• Run the ListWafLogs operation to view log activity.

  You can filter logs by the following logType options:

  • ACCESS_RULES

  • CAPTCHA_CHALLENGE

  • JAVASCRIPT_CHALLENGE

  • PROTECTION_RULES

  • HUMAN_INTERACTION_CHALLENGE

  • DEVICE_FINGERPRINT_CHALLENGE

  • THREAT_INTELLIGENCE_FEEDS

  • ADDRESS_RATE_LIMITING

  • ACCESS

  Logs can be filtered by logType by making the following request:

  GET /20181116/waasPolicies/unique_ID/wafLogs?logType=logType&timeObservedGreaterThanOrEqualTo=timestamp&timeObservedLessThan=timestamp&compartmentId=unique_ID

  For example:

  GET /20181116/waasPolicies/ocid1.waaspolicy.oc1../wafLogs?logType=PROTECTION_RULES&timeObservedGreaterThanOrEqualTo=2019-10-24T13:00:00+00:00&timeObservedLessThan=2019-10-24T13:47:00+00:00&compartmentId=ocid1.compartment.oc1..

  The following response output for the filtered logs is returned:

  [
      {
          "action": "BLOCK",
          "clientAddress": "192.0.2.0",
          "countryCode": "US",
          "countryName": "United States",
          "domain": "example.com",
          "httpHeaders": {
              "Accept": "*/*",
              "Host": "example.com",
              "Referer": "",
              "Request-Id": "2019-10-24T13:46:25Z|fa68cab479|192.0.2.0|uwDPcqR0Qt",
              "User-Agent": "curl/7.54.0",
              "X-Client-Ip": "192.0.2.0",
              "X-Country-Code": "US",
              "X-Forwarded-For": "192.0.2.0, 192.0.2.0"
          },
          "httpMethod": "GET",
          "httpVersion": "HTTP/1.1",
          "incidentKey": "2019-10-24T13:46:25Z|fa68cab479|192.0.2.0|uwDPcqR0Qt",
          "logType": "PROTECTION_RULES",
          "protectionRuleDetections": {
              "950002": {
                  "Message": "System Command Access. Matched Data: cmd.exe found within ARGS:abc: cmd.exe",
                  "Message details": "Access denied with code 403 (phase 2). Pattern match \"\\\\b(?:(?:n(?:map|et|c)|w(?:guest|sh)|telnet|rcmd|ftp)\\\\.exe\\\\b|cmd(?:(?:32)?\\\\.exe\\\\b|\\\\b\\\\W*?\\\\/c))\" at ARGS:abc."
              }
          },
          "requestUrl": "/?abc=cmd.exe",
          "timestamp": "Thu, 24 Oct 2019 13:46:25 GMT",
          "userAgent": "curl/7.54.0"
      },
      {
          "action": "BLOCK",
          "clientAddress": "192.0.2.0",
          "countryCode": "US",
          "countryName": "United States",
          "domain": "example.com",
          "httpHeaders": {
              "Accept": "*/*",
              "Host": "example.com",
              "Referer": "",
              "Request-Id": "2019-10-24T13:46:25Z|43bd96b710|192.0.2.0|E04WECJbcY",
              "User-Agent": "curl/7.54.0",
              "X-Client-Ip": "192.0.2.0",
              "X-Country-Code": "US",
              "X-Forwarded-For": "192.0.2.0, 192.0.2.0"
          },
          "httpMethod": "GET",
          "httpVersion": "HTTP/1.1",
          "incidentKey": "2019-10-24T13:46:25Z|43bd96b710|192.0.2.0|E04WECJbcY",
          "logType": "PROTECTION_RULES",
          "protectionRuleDetections": {
              "950002": {
                  "Message": "System Command Access. Matched Data: cmd.exe found within ARGS:abc: cmd.exe",
                  "Message details": "Access denied with code 403 (phase 2). Pattern match \"\\\\b(?:(?:n(?:map|et|c)|w(?:guest|sh)|telnet|rcmd|ftp)\\\\.exe\\\\b|cmd(?:(?:32)?\\\\.exe\\\\b|\\\\b\\\\W*?\\\\/c))\" at ARGS:abc."
              }
          },
          "requestUrl": "/?abc=cmd.exe",
          "timestamp": "Thu, 24 Oct 2019 13:46:25 GMT",
          "userAgent": "curl/7.54.0"
      }
  ]
  

Delivering WAF Logs to Object Storage 🔗