Overview

WAF logs information on cyberattacks by default, which includes the time, source IP, type, and details of attacks. You can set filters to query logs as needed and download the query results.

Instructions

Querying attack logs

1. Log in to the WAF Console and choose Web Application Firewall -> Attack Log on the left sidebar. On the Attack Log page, click Log Search, select the target domain name in the drop-down list at the top, set search criteria as needed, and click Search to view the corresponding attack logs.
   

Search criteria description:
- Domain name: select the target domain name in the domain name drop-down list.
- Attack time: it is Last 1 hour by default. You can search attack logs of up to 30 days.
- Risk grade: it is All risk grades by default. You can select Major, Medium, or Minor.
- Action: it is All actions by default. You can select Observation or Block.
- Rule ID: enter the target rule ID, which can be found in the log entries.
- Attack source IP: enter the attack source IP that you want to search.
2. Click the button at the upper-right corner. In the Custom fields dialog box, select the fields to be displayed in the list, as shown in the following figure.

3. View the attack details. Select the target log entry and click details in the "Operation" column on the right to view the attack details.

4. On the log details page, view the corresponding fields.

Log details field description:

• Basic Info

• Attack IP Details

• Details

Downloading attack logs

1. Log in to the WAF Console and select Web Application Firewall -> Attack Log on the left sidebar. On the Attack Log page, click Log Search and click the download icon in the upper-right corner to create a download task.
   

   Note：

   • Only one download task can be created within a certain time period.
   • Up to 10,000 logs can be downloaded at a time. If you want to download more logs, we recommend that you download them in multiple batches or contact us for assistance.
   • If you select a wildcard domain name (e.g., *.abc.com), logs of all associated subdomain names such as those suffixed with .abc.com will also be downloaded.

2. Click the Download Task tab, select a target download task, and click Download in the Operation column on the right to download the log file to your local file system.
   

   Note：

   As the log file is in CSV format and encoded in UTF-8, it is incompatible with Excel. If opened in Excel, the attack type will appear as garbled text. Please use compatible editors such as WPS or Sublime to open it.

** Log file field description:**