How is a WAF report created; which formats are available in the UI and by e-mail (HTML, PDF, XLSX)?

Short answer

The report is generated on the WAF Report tab of the vService screen; the tab is opened with the For Detailed Analysis → WAF Report shortcut on the Dashboard toolbar or with the Generate Report link of the Periodic Reporting card in WAF Management. In the form opened with Generate Report, Report Type (html default, xlsx, pdf), Date (default the last 1 day), Report Language for xlsx and pdf only, the row limit of the selected type and the optional Report Filter are selected and Accept is clicked. All three formats are available in the interface: the html report opens in the tab with six views (Overview, Attacks, Classification, Traffic, Client, Country) and is lost when the tab is closed; pdf and xlsx are downloaded as files. By e-mail, only pdf and xlsx are used: on the Periodic Reporting card, E-mail Report is turned on and the addresses, the content (pdf, xlsx or both) and the frequency (Daily, Weekly, Monthly, Annual) are selected. A single report for all WAF-protected vServices is generated on the Global WAF Report screen. Reports are not stored on the device.

Problem: The WAF Activity of a Period Is Requested as a Document

How many attacks were caught in a period, which signatures were triggered, which countries the attacks came from and which OWASP items they correspond to are to be presented as a document to the management, to the audit or to the application team. The Dashboard charts stay on the screen, and Event Logs shows individual records; for a period summary, a report is generated.

Solution: Three Methods

Your situation	Suitable method
Getting the report of a single vService now (HTML, PDF or XLSX)	Method 1: WAF Report
Seeing all WAF-protected vServices in a single report	Method 2: Global WAF Report
Receiving the report regularly by e-mail (PDF, XLSX)	Method 3: Periodic Reporting

Method 1: WAF Report Recommended

• How it worksWAF Report is generated from the Event Logs records in the selected period; in a cluster setup, the records of the two devices are combined. The report is generated at the time of the request: the wait is at most 5 minutes for HTML and at most 30 minutes for PDF and XLSX.
• Where it is opened On the vService screen, Dashboard → For Detailed Analysis → WAF Report
• Requirement WAF permission (the vService WAF screen where the report is opened, including the Dashboard tab, opens with this permission); the host group working in Monitor or Blocking mode (in Learning mode, no record is created)
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the WAF Report tab

In the Left Monitor Panel → WAF-Protected vServices → vService → Dashboard tab, the For Detailed Analysis → WAF Report shortcut on the toolbar is clicked; a closable WAF Report tab opens on the same screen (how to access). If a relative range (e.g. the last 1 day) is selected on the Dashboard, the report form comes with this range. The same tab is also opened with the Generate Report link of the Periodic Reporting card on the WAF Management tab.

2

Adım 2 Open the report form

The Generate Report button on the tab is clicked; the WAF Report window opens (Generate Report screen).

3

Adım 3 Select the format and the period

html (default), xlsx or pdf is selected as the Report Type. In the Date field, one of the preset ranges (1 hour – 3 months), a custom duration or a start and end date is selected.

4

Adım 4 Set the language and the row limit

If xlsx or pdf is selected, the Report Language field appears; Default generates the report in the interface language of the user who makes the request. Depending on the selected type, the HTML Max. Table Rows, XLSX Max. Table Rows or PDF Max. Table Rows field appears; at least 5 is entered, and if it is left empty, 100 is used (How do I set the report language and the maximum number of rows in a report?).

5

Adım 5 Select the filter (if needed)

Report Filter uses all attack records with the default No Restriction; in the Select position, the condition builder of Event Logs opens (Can I produce a report containing only certain attacks with the report filter?).

6

Adım 6 Generate the report

Accept is clicked. While the generation is in progress, the Generate Report button stays disabled. The html report opens in the tab; the pdf and xlsx file is downloaded with the name WAF_<vService-name>_<start> - <end>. The form selections are remembered per user.

Format	Where	Content
html	WAF Report tab	Six views: Overview (summary indicators, country map), Attacks, Classification (OWASP Web, OWASP API, CWE, CAPEC, MITRE ATT&CK, category, target), Traffic (method, path, body length, WAF time, hourly distribution), Client, Country; if there is more than one host group, it is examined by selecting the group (HTML report)
pdf	Downloaded file	Cover (organization logo, vService name, report range), table of contents, summary section and detail sections per host group; at most 10 rows in tables (25 in breakdowns without a chart) (PDF)
xlsx	Downloaded file	A summary sheet and a separate sheet for each breakdown; on each sheet, as many rows as XLSX Max. Table Rows, at most 1,000 (XLSX)

Verification

1HTML reportTR7 side

The Overview view on the tab is examined.

ExpectedTotal Attacks, Unique Attacker IPs, Attacking Countries, Triggered Rules, Top CWE indicators and the country map

2PDF / XLSXClient side

The download folder of the browser is examined.

ExpectedWAF_vService name_start - end.pdf

Method 2: Global WAF Report

• How it worksGlobal WAF Report collects the records of all WAF-protected vServices in a single report; the report starts with the All vServices section, followed by the vServices. The form is the same as the WAF Report form and additionally contains the vService field.
• Where it is openedWAF → Global WAF Report
• Requirement WAF permission; an account whose permission is not restricted to specific vServices
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the screen

The WAF → Global WAF Report steps are followed (how to access).

2

Adım 2 Open the report form

The Generate Report button is clicked (Generate Report screen).

3

Adım 3 Fill in the form

Report Type, Date, Report Language if needed, the row limit and Report Filter are selected as in Method 1. The vService field covers all vServices with the default All vServices; with Pick vServices, the vServices to be included in the report are selected.

4

Adım 4 Generate the report

Accept is clicked. Details: Can I get a single WAF report for the whole device (Global WAF Report)?

Verification

1Report sectionsTR7 side

The section selector of the HTML report is examined.

ExpectedAll vServices and the vServices that received attacks

Method 3: Periodic Reporting (E-mail)

• How it worksPeriodic Reporting generates, for each selected period, the report of the previous full period and sends it as an e-mail attachment; only the pdf and xlsx formats are used in e-mail.
• Where it is opened On the vService screen, WAF Management → Periodic Reporting card → pencil icon
• Requirement Modify permission in the WAF area; E-mail Settings (SMTP) defined on the Settings → General Settings → Notification Management screen
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the WAF Management tab

The Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab is opened.

2

Adım 2 Open the Periodic Reporting window

The pencil icon at the top right of the Periodic Reporting card in the Learning & Reporting row is clicked; the Periodic Reporting window opens (Periodic Reporting Edit screen).

3

Adım 3 Turn on the e-mail report

The E-mail Report switch is turned on (off by default); three fields appear below it.

4

Adım 4 Fill in the fields

The recipients are entered line by line in the E-mail Addresses field. In the E-mail Report Content field, pdf, xlsx or both are checked. In the E-mail Frequency field, at least one of the Daily, Weekly, Monthly, Annual periods is selected; a separate report is sent for each selected period.

5

Adım 5 Save

Edit is clicked; there is no separate deployment step. Sending times and details: Can I receive reports regularly by e-mail; at what times are they sent?

Verification

1Card sentenceTR7 side

The summary sentence on the Periodic Reporting card is examined.

ExpectedThe WAF report is e-mailed Daily to 1 addresses (PDF)

If no address is entered, the card shows the "E-mail reporting is on but no address is defined" warning.

Common Mistakes

• Expecting the HTML report by e-mail. The e-mail is sent only with PDF and XLSX attachments.
• Assuming that the HTML report is stored. When the WAF Report tab is closed or the page is refreshed, the report is lost; a report to be kept is downloaded as PDF or XLSX.
• Expecting a report for a vService in Learning mode. The report is generated from Event Logs records; since no record is written in Learning mode, the attack tables come empty.
• Forgetting the filter left in the form. The form selections are remembered; the Report Filter selected in the previous report also stays in effect in the next report, and the Filtered report badge appears on the document.
• Not defining the e-mail server. If there is no SMTP setting, the scheduled report cannot be sent, and the card does not warn about this separately.

How it is done in the documentation

• WAF Report · The Generate Report Screen
• WAF Report · The HTML Report
• WAF Report · The PDF and XLSX Outputs
• Periodic Reporting · The Periodic Reporting Edit Screen

Related questions

• Can I receive reports regularly by e-mail; at what times are they sent?
• Can I get a single WAF report for the whole device (Global WAF Report)?
• How is a report created; which formats are available (HTML, PDF, XLSX)?