WAF metrics

Web application firewall (WAF) metrics show request, attack, block, and bot-detection counts. Equal step and range values produce nonoverlapping five-minute count buckets.

Query scope

Query XCSH_NAMESPACE over the fixed two-hour XCSH_START_TIME–XCSH_END_TIME window. Group by VIRTUAL_HOST and retain only the discovered XCSH_VIRTUAL_HOST in the summary. The current demo requires its blocking application firewall and traffic.

Request procedure

1. Build the firewall request.

   XCSH_REQUEST="$(jq -nc --arg ns "<XCSH_NAMESPACE>" --arg start "$XCSH_START_TIME" \
     --arg end "$XCSH_END_TIME" '{
       namespace: $ns, start_time: $start, end_time: $end,
       step: "5m", range: "5m",
       field_selector: ["TOTAL_REQUESTS", "ATTACKED_REQUESTS",
                        "BLOCKED_REQUESTS", "BOT_DETECTION"],
       group_by: ["VIRTUAL_HOST"]
     }')"

2. Query the counters.

   curl --silent --show-error --fail-with-body --request POST \
     --header "Authorization: APIToken <XCSH_API_TOKEN>" \
     --header 'Content-Type: application/json' \
     --data-binary "$XCSH_REQUEST" \
     "<XCSH_API_URL>/api/data/namespaces/<XCSH_NAMESPACE>/app_firewall/metrics" |
   jq -er --arg vh "<XCSH_VIRTUAL_HOST>" '{
     step,
     metrics: [.data[]? | {
       type,
       total: ([.data[]? | select(.key.VIRTUAL_HOST == $vh)
                | .value[]?.value | tonumber] | add // 0)
     }]
   }'

Observed response

Captured 2026-10-06T03:13:55Z; HTTP 200. Totals cover the two-hour query window.

{
  "step": "5m",
  "metrics": [
    {
      "type": "BOT_DETECTION",
      "total": 26
    },
    {
      "type": "ATTACKED_REQUESTS",
      "total": 26
    },
    {
      "type": "BLOCKED_REQUESTS",
      "total": 26
    },
    {
      "type": "TOTAL_REQUESTS",
      "total": 832
    }
  ]
}

Expect step and available TOTAL_REQUESTS, ATTACKED_REQUESTS, BLOCKED_REQUESTS, and BOT_DETECTION totals. The filter uses 0 when no matching buckets exist; this fallback is not a measured zero. Inspect the original response before interpreting a zero total. Compare blocks with security events.