POST https://console.baleen.cloud/api/logs/waf-logs
...
| Table of Contents | ||||
|---|---|---|---|---|
|
Authorization
| Note |
|---|
|
...
Body Params
filters objectdescription
Optional This object is an optional array allowing to define the filters to apply on the waf logs using the following parameters.
Param | Type | Description |
|---|---|---|
field | enum | The field targeted to filter the logs Has to be one of the following value :
|
operator | enum | The operator used to filter the logs Has to be one of the following value :
|
value | string | The value considered to filter the logs |
...
Field | Type | Description |
|---|---|---|
transaction |
| Anchor | ||||
|---|---|---|---|---|
|
This object gathers information about the threat(s) identified by the OWASP ruleset
Field | Type | Description |
|---|---|---|
clientIP | string | |
clientPort | integer | |
hostIP | string | |
hostPort | integer | |
messages | ||
producer | ||
request | ||
response | ||
serverId | String | |
timeStamp | string | |
uniqueId | string |
| Anchor | ||||
|---|---|---|---|---|
|
This array helps to understand why the request is seen as a threat : there is a messages occurrence for each OWASP rule triggered
Field | Type | Description |
|---|---|---|
details | ||
message | string |
| Anchor | ||||
|---|---|---|---|---|
|
This object gives precise details about the rule triggered (its ID and severity) and the reason of the trigger
Field | Type | Description |
|---|---|---|
accuracy | string | |
data | string | |
file | string | |
lineNumber | string | |
match | string | |
maturity | string | |
reference | string | |
rev | string | |
ruleId | string | |
severity | string | |
tags | string[] | |
ver | string |
| Anchor | ||||
|---|---|---|---|---|
|
This object gives information about ModSecurity : the producer of the waf log.
Field | Type | Description |
|---|---|---|
components | string[] | |
connector | string | |
modsecurity | string | |
secrulesEngine | string |
| Anchor | ||||
|---|---|---|---|---|
|
This object gathers information about the initial HTTP request
Field | Type | Description |
|---|---|---|
headers | string[] | |
httpVersion | number | |
method | string | |
uri | string |
| Anchor | ||||
|---|---|---|---|---|
|
This object gathers information about the HTTP response
Field | Type | Description |
|---|---|---|
headers | string[] | |
httpCode | string |
Unsuccessful request
400 Bad request
500 Internal server error
Example
The following example shows an API call retrieving security events created after a request triggered the rule 920320 between April 25th 2023 3PM and April 25th 2023 8PM.
...