WAF and application security

Request and rule-hit counters, events, incidents, suspicious users, and security evidence. Required resource or feature: Web application firewall (WAF) or application security feature.

Metric families and dimensions

Request, event, and client/server rule-hit counters. Dimensions include virtual host, event type, site, service, instance, rule identifier/severity/tag, firewall mode, and bot classification, depending on the endpoint. |

Current empty security counters

The application security metrics query with namespace and VH_NAME returned HTTP 200 with empty counters. Retain the measured WAF counters and authoritative event logs; capture meaningful points before presenting application security counts. See the empty security-event metric response for its timestamps and response.

Use Query concepts for shared request guidance and table conventions.

Statistics and analytics queries

Method and exact path	Information returned	Scope and principal filters	Specification reference
POST /api/data/namespaces/system/app_firewall/all_ns_metrics	Bot detection, attacked, blocked, and total request counters across namespaces	Tenant; system only; end_time, field_selector, filter, group_by, is_trend_request, range, start_time, step	Operation · Request schema · Response schema
POST /api/data/namespaces/system/app_security/all_ns_events	Security Events Query All Namespaces; returns aggs, events, last_sort_values, scroll_id, total_hits	Tenant; system only; aggs, end_time, limit, query, scroll, search_after, sort, sort_by, sort_values, start_time	Operation · Request schema · Response schema
POST /api/data/namespaces/system/app_security/all_ns_events/aggregation	Security Events Aggregation Query All Namespaces; returns aggs, total_hits	Tenant; system only; aggs, end_time, query, start_time	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/app_firewall/metrics	Bot detection, attacked, blocked, and total request counters	Selected namespace; end_time, field_selector, filter, group_by, is_trend_request, range, start_time, step	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/app_security/events	Security Events Query; returns aggs, events, last_sort_values, scroll_id, total_hits	Selected namespace; system can query across namespaces; aggs, end_time, limit, query, scroll, search_after, sort, sort_by, sort_values, start_time	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/app_security/events/aggregation	Security Events Aggregation Query; returns aggs, total_hits	Selected namespace; system can query across namespaces; aggs, end_time, query, start_time	Operation · Request schema · Response schema
GET /api/data/namespaces/{namespace}/app_security/events/scroll	Security Event Scroll Query; returns aggs, events, last_sort_values, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/app_security/events/scroll	Security Event Scroll Query; returns aggs, events, last_sort_values, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/app_security/evidence	Security Evidence Query; returns aggs, evidences, last_sort_values, total_hits	Selected namespace; aggs, end_time, limit, query, search_after, sort, sort_by, sort_values, start_time	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/app_security/incidents	Security Incidents Query; returns aggs, incidents, last_sort_values, scroll_id, total_hits	Selected namespace; system can query across namespaces; aggs, end_time, limit, query, scroll, search_after, sort, sort_by, sort_values, start_time	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/app_security/incidents/aggregation	Security Incidents Aggregation Query; returns aggs, total_hits	Selected namespace; system can query across namespaces; aggs, end_time, query, start_time	Operation · Request schema · Response schema
GET /api/data/namespaces/{namespace}/app_security/incidents/scroll	Security Incidents Scroll Query; returns aggs, incidents, last_sort_values, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/app_security/incidents/scroll	Security Incidents Scroll Query; returns aggs, incidents, last_sort_values, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/app_security/metrics	Security-event counts grouped by virtual host, event type, or source	Selected namespace; end_time, group_by, label_filter, start_time, step	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/app_security/suspicious_user_logs	Suspicious User Logs Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; system can query across namespaces; aggs, end_time, limit, query, scroll, search_after, sort, sort_by, sort_values, start_time	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/app_security/suspicious_user_logs/aggregation	Suspicious User Logs Aggregation Query; returns aggs, total_hits	Selected namespace; system can query across namespaces; aggs, end_time, query, start_time	Operation · Request schema · Response schema
GET /api/data/namespaces/{namespace}/app_security/suspicious_user_logs/scroll	Suspicious User Logs Scroll Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/app_security/suspicious_user_logs/scroll	Suspicious User Logs Scroll Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/wafs/metrics/client/rule_hits	Client Rule Hits Metrics; returns data, step	Selected namespace; end_time, group_by, label_filter, range, start_time, step	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/wafs/metrics/client/security_events	Client Security Events Metrics; returns data, step	Selected namespace; end_time, group_by, label_filter, range, start_time, step	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/wafs/metrics/server/rule_hits	Server Rule Hits Metrics; returns data, step	Selected namespace; end_time, group_by, label_filter, range, start_time, step	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/wafs/metrics/server/security_events	Server Security Events Metrics; returns data, step	Selected namespace; end_time, group_by, label_filter, range, start_time, step	Operation · Request schema · Response schema
POST /api/ml/data/namespaces/{namespace}/virtual_hosts/{vh_name}/staged_signatures	Staged WAF signatures and observed hits	Selected namespace; vh_name, end_time, start_time	Operation · Request schema · Response schema

Related discovery and status

Method and exact path	Information returned	Scope and principal filters	Specification reference
POST /api/data/namespaces/system/app_security/all_ns_search/loadbalancers	Search load balancers All Namespaces; returns loadbalancers	Tenant; system only; label_filter	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/app_security/search/loadbalancers	Search load balancers; returns loadbalancers	Selected namespace; label_filter	Operation · Request schema · Response schema
GET /api/waf/attack-signatures	list Attack Signatures; returns attack_signatures, not_modified, version	Tenant or entitled peer group; known_version	Operation · Request schema · Response schema
GET /api/waf/bot-signatures	list Bot Signatures; returns bot_signatures, not_modified, version	Tenant or entitled peer group; known_version	Operation · Request schema · Response schema
GET /api/waf/latest-signatures-version	Latest Version; returns version	Tenant or entitled peer group; No additional selector	Operation · Request schema · Response schema
GET /api/waf/threat-campaigns	list Threat Campaigns; returns not_modified, threat_campaigns, version	Tenant or entitled peer group; known_version	Operation · Request schema · Response schema
GET /api/waf/threat_campaign/{id}	Threat Campaign by ID; returns attack_type, description, id, intent, last_update	Tenant or entitled peer group; id	Operation · Request schema · Response schema
POST /api/waf/threats	Threats; returns next_cursor, threats	Tenant or entitled peer group; cursor, cve_ids, primary_tag, report_fields, waf_sec_event_id	Operation · Request schema · Response schema

Existing reports and artifacts

Method and exact path	Information returned	Scope and principal filters	Specification reference
POST /api/report/namespaces/{namespace}/report_configs/list-reports-history-waap	Reports History Waap; returns items, reports, reports_list	Selected namespace; include_all, report_config_names	Operation · Request schema · Response schema