Client Security Events Metrics.

POST

/api/data/namespaces/{namespace}/wafs/metrics/client/security_events

const url = 'https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/data/namespaces/example/wafs/metrics/client/security_events';
const options = {
  method: 'POST',
  headers: {Authorization: '<Authorization>', 'Content-Type': 'application/json'},
  body: '{"end_time":"example","group_by":["NAMESPACE"],"label_filter":[{"label":"NAMESPACE","op":"EQ","value":"example"}],"namespace":"example","range":"example","start_time":"example","step":"example"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/data/namespaces/example/wafs/metrics/client/security_events \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "end_time": "example", "group_by": [ "NAMESPACE" ], "label_filter": [ { "label": "NAMESPACE", "op": "EQ", "value": "example" } ], "namespace": "example", "range": "example", "start_time": "example", "step": "example" }'

GET number of security events per client for a given namespace. The security events counter can be aggregated based on one or more labels listed here. NAMESPACE, APP_TYPE, VIRTUAL_HOST, SITE, SERVICE, INSTANCE, WAF_INSTANCE_ID, WAF_MODE.

Examples of this operation.

Authorizations

ApiToken

Parameters

Path Parameters

namespace

required

string

Namespace namespace is used to scope the WAF security events for the given namespace.

Request Body^required

application/json

SecurityEventsCountRequest

Request to GET number of security events per client/server for a given namespace.

object

end_time

End time

End time of metric collection from which data will be considered. Format: unix_timestamp|RFC 3339

Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to

string

<= 1024 characters

group_by

Group by

Aggregate data by one or more labels listed here. NAMESPACE, APP_TYPE, VIRTUAL_HOST, SITE, SERVICE, INSTANCE, WAF_INSTANCE_ID, WAF_MODE.

Optional: If not specified, then the rule hits are aggregated/grouped by VIRTUAL_HOST.

Array<string>

Allowed values: NAMESPACE APP_TYPE VIRTUAL_HOST SITE SERVICE INSTANCE WAF_INSTANCE_ID RULE_ID RULE_SEVERITY RULE_TAG WAF_MODE BOT_TYPE BOT_NAME

label_filter

Label Filter

List of label filter expressions of the form “label” Op “value”. Response will only contain data that matches all the conditions specified in the label_filter. One or more of the following labels can be specified in the label_filter. APP_TYPE, VIRTUAL_HOST, SITE, SERVICE, INSTANCE, WAF_INSTANCE_ID, WAF_MODE.

Optional: If not specified, then the metrics will be filtered only based on the namespace in the request.

Array<object>

Label based filtering of WAF metrics.

WAF metrics are tagged with labels mentioned in MetricLabel. Metric label filter can be specified to query specific metrics based on label match.

object

label

string

default: NAMESPACE

Allowed values: NAMESPACE APP_TYPE VIRTUAL_HOST SITE SERVICE INSTANCE WAF_INSTANCE_ID RULE_ID RULE_SEVERITY RULE_TAG WAF_MODE BOT_TYPE BOT_NAME

string

default: EQ

Allowed values: EQ NEQ

value

Value

Value to be compared with.

string

>= 3 characters <= 1024 characters

namespace

Namespace

Namespace is used to scope the WAF security events for the given namespace.

string

>= 6 characters <= 1024 characters

range

Range

Range decides how far to go back in time to fetch values for each step. For example, if the range is 5m, then for step t1, query will be evaluated for t1-5m and for t2, query will be evaluated for t2-5m and so on. Format: [0-9][smhd], where s - seconds, m - minutes, h - hours, d - days

Note: For non-timeseries query, i.e., for step=end_time-start_time, range should be set to end_time-start_time

Optional: If not specified, range is set to 5m.

string

<= 1024 characters

start_time

Start time

Start time of metric collection from which data will be considered. Format: unix_timestamp|RFC 3339

Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to -10m.

string

<= 1024 characters

step

Step

Step is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in the response. The timestamps in the response will be t1=start_time, t2=t1+step, … Tn=tn-1+step, where tn <= end_time. Format: [0-9][smhd], where s - seconds, m - minutes, h - hours, d - days

Optional: If not specified, then step size is evaluated to <end_time - start_time>

string

<= 1024 characters

Responses

200

A successful response.

application/json

SecurityEventsCountResponse

Number of security events for each unique combination of group_by labels in the SecurityEventsCountRequest.

object

data

Security events counter data

List of security events counter data.

Array<object>

Security Events Counter

SecurityEventsCounter contains the timeseries data of security events counter.

object

app_type

AppType

AppType configured on the vhost under which this WAF instance is running.

string

<= 1024 characters

bot_name

Bot Name

Name of the Bot associated with the WAF rule.

string

<= 1024 characters

bot_type

Bot Type

Type of Bot (crawler, scanner, script)

string

<= 1024 characters

instance

Instance

Region from which the client’s accesses caused WAF metrics to be generated.

string

<= 1024 characters

namespace

Namespace

Namespace in which this WAF instance is running.

string

>= 6 characters <= 1024 characters

service

Service

Service for which this WAF instance is reporting the metrics.

string

<= 1024 characters

site

Site

Site from which this WAF instance is reporting the metrics.

string

<= 1024 characters

virtual_host

Virtual Host

Virtual host under which this WAF instance is running.

string

<= 1024 characters

waf_instance_id

WAF Instance ID

WAF instance ID.

string

<= 1024 characters

waf_mode

WAF Mode

Block or AlertOnly.

string

<= 1024 characters

metric

Metric Values

List of metric values.

Array<object>

Metric Value

Metric data contains timestamp and the value.

object

timestamp

Timestamp

Timestamp

number format: double

trend_value

object

description

Description

Description of the method used to calculate trend.

string

>= 21 characters <= 1024 characters

previous_value

Previous Value

Configuration parameter for previous value

string

<= 1024 characters

sentiment

string

default: TREND_SENTIMENT_NONE

Allowed values: TREND_SENTIMENT_NONE TREND_SENTIMENT_POSITIVE TREND_SENTIMENT_NEGATIVE

value

Value

Configuration parameter for value

string

>= 3 characters <= 1024 characters

value

Value

Configuration parameter for value

string

>= 3 characters <= 1024 characters

step

step

Actual step size used in the response. It could be higher than the requested step due to metric rollups and the query duration. Format: [0-9][smhd], where s - seconds, m - minutes, h - hours, d - days.

string

<= 1024 characters

Example

{
  "data": [
    {
      "metric": [
        {
          "trend_value": {
            "sentiment": "TREND_SENTIMENT_NONE"
          }
        }
      ]
    }
  ]
}

401

Returned when operation is not authorized.

application/json

string format: string

Example^generated

example

403

Returned when there is no permission to access resource.

application/json

string format: string

Example^generated

example

404

Returned when resource is not found.

application/json

string format: string

Example^generated

example

409

Returned when operation on resource is conflicting with current value.

application/json

string format: string

Example^generated

example

429

Returned when operation has been rejected as it is happening too frequently.

application/json

string format: string

Example^generated

example

500

Returned when server encountered an error in processing API.

application/json

string format: string

Example^generated

example

503

Returned when service is unavailable temporarily.

application/json

string format: string

Example^generated

example

504

Returned when server timed out processing request.

application/json

string format: string

Example^generated

example

Client Security Events Metrics.

Authorizations

Parameters

Path Parameters

Request Bodyrequired

Responses

200

Example

401

Examplegenerated

403

Examplegenerated

404

Examplegenerated

409

Examplegenerated

429

Examplegenerated

500

Examplegenerated

503

Examplegenerated

504

Examplegenerated

Request Body^required

Example^generated

Example^generated

Example^generated

Example^generated

Example^generated

Example^generated

Example^generated

Example^generated