Query WAF Attack Details - DescribeWafAttackDetailListInfo

Overview

Query WAF Attack Details

Definition

Public Parameters

Parameter Name	Type	Description Information	Required
Action	string	Corresponding API command name, the current API is `DescribeWafAttackDetailListInfo`.	Yes
PublicKey	string	The user's public key can be obtained from Console (opens in a new tab)	Yes
Signature	string	User signature generated based on public key and API command, see Signature Algorithm	Yes

Request Parameters

Parameter Name	Type	Description Information	Required
ProjectId	string	Project ID, leave blank for default project	No
Offset	int	Page Offset	Yes
Limit	int	Page Quantity Limit	Yes
TimeType	string	Time unit; Options: Hour\|Day\|Week\|Month\|Custom; Default is Hour	No
AttackType.N	string	Attack Types ["scan", "loopholes", "xss", "cc", "sql", "exec", "webshell", "infoleak", "eaa", "protocol", "other"]	No
RiskRank.N	string	Risk Level	No
ActionType.N	string	Matching actions, intercept, allow, alert	No
BeginTime	int	Custom Start Timestamp	No
EndTime	int	Custom End Timestamp	No
FullDomain	string	The domain name to be queried, query all when empty.	No

Response Field

Field Name	Type	Description Information	Required
RetCode	int	Return status code. If it is 0, it means successful return. If it is not 0, it means failure.	Yes
Action	string	Operation command name.	Yes
Message	string	Returns an error message, providing detailed description when `RetCode` is non-zero.	No
DetailList	array[WafAttack]	Attack Details List, refer to WafAttack	No
TotalCount	int	Total Attack Details	No

Data Model

WafAttack

Field Name	Type	Description Information	Required
Region	string	Region	No
Protocol	string	Protocol	No
ServerName	string	Server Name	No
DestIp	string	Target IP Address	No
Port	string	Port	No
Alerts	array[WafAlert]	Alarm matching information, refer to WafAlert	No
Attack	string	Attack Type	No
Method	string	Request Method	No
FalsePositive	boolean	False Alarm	No
RiskRank	string	Risk Level	No
TimeStamp	int	Attack Timestamp	No
Host	string	Hostname	No
Referer	string	Reference Address	No
Count	int	Attack Times	No
Uri	string	URI	No
Client	string	Client	No
Mode	string	Working Mode	No
Action	string	Matching Action	No
UA	string	User Agent	No
Args	string	Parameters	No

WafAlert

Field Name	Type	Description Information	Required
Description	string	Rule Description	No
Id	int	Matching Rule ID	No

Example

Request Example

https://api.surfercloud.com/?Action=DescribeWafAttackDetailListInfo
&ProjectId=org-xxx
&AttackType=xss
&RiskRank=high
&Domain=www.test.com
&Offset=0
&Limit=10
&TimeType=Hour

Response Example

{
  "Action": "DescribeWafAttackDetailListInfoResponse",
  "DetailList": [
    {
      "AccessId": "183.238.16.138-f97f82ee",
      "Action": "DENY",
      "Alerts": [
        {
          "Description": "XSS",
          "Id": 32003,
          "Match": {
            "0": "alert(",
            "14": "alert(",
            "34": "alert"
          }
        }
      ],
      "Args": "ctg=%22%20onmouseover=%22alert(1295)",
      "Attack": "xss",
      "Client": "183.238.16.138",
      "ClientIPInfo": {
        "city_name": "深圳",
        "country_name": "中国",
        "latitude": "22.547",
        "longitude": "114.085947",
        "owner_domain": "",
        "region_name": "广东",
        "timezone": "Asia/Shanghai"
      },
      "Count": 1,
      "DestIp": "106.5.9.224",
      "FalsePositive": false,
      "Host": "www.test.com",
      "Id": "5e8c1db1243527db1df81bc2",
      "Method": "GET",
      "Mode": "SIMULATE",
      "Port": "80",
      "Protocol": "http",
      "Referer": "NULL",
      "Region": "cn-bj",
      "RequestBody": null,
      "RequestHeaders": {
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "AcceptEncoding": "",
        "AcceptLanguage": "en-US",
        "CacheControl": "",
        "Connection": "",
        "Cookie": "",
        "Host": "www.test.com",
        "UpgradeInsecureRequests": "",
        "UserAgent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0)",
        "XForwardFor": ""
      },
      "RiskRank": "high",
      "ServerName": "www.test.com",
      "TimeStamp": 1586240945,
      "TopId": 0,
      "UA": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0)",
      "Uri": "/professor.php?ctg=%22%20onmouseover=%22alert(1295)"
    }
  ],
  "RetCode": 0,
  "TotalCount": 1
}

DescribeAutoWafDomainBlackList DescribeWafAttackFalseAlarmListInfo