v1

latestSwagger 2.0Apache 2.02026-07-174372196.9 KB

WAF安全日志

获取详细攻击日志

查询详细的WAF攻击日志记录，提供多条件筛选和分页功能，支持按规则ID、IP、域名、端口和时间范围过滤

get/api/v1/waf/logs

Query parameters

ruleIdinteger

规则ID，触发攻击检测的WAF规则标识

srcIpstring

来源IP地址，攻击者地址

dstIpstring

目标IP地址，被攻击的服务器地址

domainstring

域名，被攻击的站点域名

srcPortinteger

来源端口号，发起攻击的端口

dstPortinteger

目标端口号，被攻击的服务端口

requestIdstring

请求ID，唯一标识HTTP请求的ID

startTimestring

查询起始时间 (ISO8601格式，如: 2024-03-17T00:00:00Z)

endTimestring

查询结束时间 (ISO8601格式，如: 2024-03-18T23:59:59Z)

pageinteger

当前页码，从1开始计数 (默认: 1)

pageSizeinteger

每页记录数，最大100条 (默认: 10)

Response

成功

codeinteger

messagestring

requestIdstring

successboolean

timestampstring

Example response

{
  "code": 200,
  "data": {
    "currentPage": 1,
    "pageSize": 10,
    "results": [
      {
        "accuracy": 9,
        "clientIp": "192.168.1.1",
        "createdAt": "2024-03-18T08:12:33Z",
        "domain": "api.example.com",
        "dstIp": "10.0.0.1",
        "dstPort": 443,
        "logs": [
          {
            "accuracy": 9,
            "logRaw": "[2024-03-18 08:12:33] [error] ModSecurity: Access denied with code 403 (phase 1). Matched \"Operator 'Rx' with parameter '(?:scanner)' against variable 'REQUEST_HEADERS:User-Agent'\" [id \"10086\"] [msg \"恶意扫描器检测\"] [severity \"CRITICAL\"]",
            "message": "恶意扫描器检测",
            "payload": "Scanner/1.0",
            "phase": 1,
            "ruleId": 10086,
            "secLangRaw": "SecRule REQUEST_HEADERS:User-Agent \"@rx (?:scanner)\" \"id:1008,phase:1,severity:'CRITICAL'\"",
            "secMark": "web_scanner",
            "severity": 2
          }
        ],
        "message": "恶意扫描器检测",
        "payload": "Scanner/1.0",
        "phase": 1,
        "request": "GET /api/v1/users HTTP/1.1\nHost: api.example.com\nUser-Agent: Scanner/1.0",
        "requestId": "a1b2c3d4e5f6",
        "response": "HTTP/1.1 403 Forbidden\nContent-Type: text/html\nContent-Length: 146",
        "ruleId": 10086,
        "secLangRaw": "SecRule REQUEST_HEADERS:User-Agent \"@rx (?:scanner)\" \"id:1008,phase:1,severity:'CRITICAL'\"",
        "secMark": "web_scanner",
        "serverIp": "10.0.0.1",
        "severity": 2,
        "srcIp": "192.168.1.1",
        "srcIpInfo": {
          "asn": {
            "number": 4134,
            "organization": "China Telecom"
          },
          "city": {
            "nameEn": "Hangzhou",
            "nameZh": "杭州"
          },
          "continent": {
            "nameEn": "Asia",
            "nameZh": "亚洲"
          },
          "country": {
            "isoCode": "CN",
            "nameEn": "China",
            "nameZh": "中国"
          },
          "location": {
            "latitude": 30.2943,
            "longitude": 120.1663,
            "timeZone": "Asia/Shanghai"
          },
          "subdivision": {
            "isoCode": "ZJ",
            "nameEn": "Zhejiang",
            "nameZh": "浙江"
          }
        },
        "srcPort": 52134,
        "uri": "/api/v1/users"
      }
    ],
    "totalCount": 128,
    "totalPages": 13
  },
  "message": "操作成功",
  "requestId": "550e8400-e29b-41d4-a716-446655440000",
  "success": true,
  "timestamp": "2023-01-01T12:00:00Z"
}