Tenant Cloud Security Web Application Firewall Operation Guide

Attack Logs

Last Updated At: 2025-10-29 17:01:36

Converge Cloud WAF collects attack logs that record details such as attack time, attacker IP, and attack type. You can query and download logs for up to 30 days in the past using full-text search, fuzzy search, or filter-based search (supporting downloads of up to 1 million logs).

Searching Attack Logs

  1. Log in to the Converge Cloud WAF Console. Select Attack Logs on the left sidebar, then go to the Log Service tab.
  2. Choose the instance, domain name, attack type, action, and attack time to search attack logs.

Field Name Descriptions

Field Name Description
Instance Select instances. By default, all instances are selected.
Domain name Select domain names. By default, all domain names are selected.
Attack type Select attack types observed or blocked by security modules. By default, all attack types are selected.
Action Select Observe or Block. By default, all actions are selected.
Risk level Select High, Medium, or Low risk. By default, all levels are selected.
Time period Specify a time range for the logs. Default: Last 1 hour.
Auto-refresh Automatically refreshes logs at the specified interval (disabled by default).
  1. Specify your search filters before clicking Search.

Analyzing Attack Logs

  1. On the top right of the log list, click to select displayed fields, then click OK. (For detailed information on each field, see Log Field Description below.)
  2. On the left of the Raw Data section, select a field to view its percentage breakdown. Then, select a value to filter results.
  3. Click to expand log details. You can also:
    - Click any field value to filter results based on that value.
    - Click JSON to view the log in JSON format.

Downloading Attack Logs

  1. On the top right of the log list, click to view your Download Tasks.
Note:

By default, your current search results will be downloaded.
Only one download task can be created at a time.
Each download task can include up to 1 million logs.
For more, create multiple tasks sequentially or contact Converge Cloud Support.
If you select a wildcard domain (e.g., *.example.com), logs from all subdomains (e.g., api.example.com, shop.example.com) will be included.

  1. On the Download Task page, click Create Task.
  2. Enter a task name and click Create.
  3. After the task is created, you can view the total number of logs, download progress, download status, creation time, and expiration time. Click Download to export the logs in CSV format.
Note:

Downloaded logs are retained for 3 days.

See Also

Log Field Description

Basic Information

Field Name Description
host The domain name accessed by the client.
uri The request URI identifying the resource.
attack_ip The source IP of the attack.
attack_type The type of attack detected.
rule_id ID of the protection rule applied (AI rule ID = 0).
method The HTTP request method used.
user_agent Information about the attacker’s browser and operating system.
risk_level Indicates the risk level of the attack.
status The action taken: 0 (Observe), 1 (Block).
count Number of attacks from the same IP within 10 seconds.
domain The domain name attacked.
pan / domain_name The accessed domain name.
attack_time The timestamp when the attack occurred.
attack_place The location within the HTTP request where the attack was detected.
action The action taken on the attack request (0: Observe, 1: Block).
ipinfo_nation Country of the attacker IP.
ipinfo_province Province or state of the attacker IP.
ipinfo_city City of the attacker IP.
ipinfo_state Country or region of the attacker IP.
ipinfo_dimensionality Latitude of the attacker IP.
instance Name of the Converge Cloud WAF instance.
attack_category Attack category (currently unavailable).
edition WAF versions: sparta-waf, clb-waf.
uuid Unique identifier of the log.
attack_content The specific content that was attacked.
http_log HTTP request and response logs.
headers Request and response headers (including custom ones).
rule_name Rule name (currently unavailable).
count Number of attacks of the same type from the same attacker IP within 10 seconds.
args_name Parameters in the HTTP request.
ipinfo_isp ISP of the attacker IP.
appid App ID of the Converge Cloud account.
ipinfo_longitude Longitude of the attacker IP.