WAAS Analytics
WAAS analytics provide users a way to investigate events and rule triggers.
- For container WAAS events go toMonitor > Events > WAAS for containers
- For host WAAS events go toMonitor > Events > WAAS for hosts
- For App-Embedded WAAS events go toMonitor > Events > WAAS for App-Embedded
- For serverless WAAS events go toMonitor > Events > WAAS for Serverless
WAAS retains up to 200,000 events for each type (container, hosts, app-embedded and serverless) or or a total of 200MB in log size. Once the limit is reached, oldest events will get over-written by new ones.
Similar audits are aggregated and grouped into a single event when received in close succession (less than 5 minutes apart). Audits are aggregated by a combination of IP, HTTP hostname, path, HTTP method, User-Agent and attack type.
Analytics workflow
WAAS analytics allows for the review of incidents by analyzing events across various dimensions, inspecting individual requests, and applying filtering to focus on common characteristics or trends.
Event graph
Each column on the timeline graph represents a dynamic period - hover over a column to reveal its start, end and event count.
The date filter can be adjusted by holding and selecting sections on the timeline graph.
Filters
Filter can be adjusted by using the filtering line:
Once set, the filters would apply on the graph and aggregation view.
You can dynamically update the date filter by selecting an area in the chart.
Click in the chart area, hold the mouse button down, and draw a rectangle over the time frame of interest.
The date filter is automatically updated to reflect your selection.
Aggregation view
The aggregation view can be altered to group audits based on various data dimensions by clicking on the button.
Users can add up to 6 dimensions to the aggregation and the Total column will be updated dynamically.
By default, aggregation view is sorted by the "Total" column. Sorting can be changed by clicking a column name.
Click on a line in the aggregation view to inspect the requests group by it.
Request view
Request view details all of the requests group by each line of the aggregated view.
Clicking on a column name will sort the table in the upper section and using the button will add/remove columns.
For each request the following data points are available:
Audit data:
- Time- timestamp of the audit.
- Effect- effect set by policy.
- Request Count- If audits are received in close succession (less than 5 minutes apart) they are aggregated and grouped into one event. This field specifies the number of aggregated requests.
- Rule Name- name of the WAAS rule that matched the request and generated the event. Navigate to the configuration of the rule by clicking on the link.