What is monitored for the WAF on the Live Stats screen?

Short answer

Live Stats shows the current status of the vService with per-second rates; it does not store data and no time range is selected. There are four sections: Frontend (Uptime, CPU, Memory Usage, WAF Attack Rate, Current Sessions, HTTP Request/s), WAF Inspection Distribution (the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning cards), WAF Detected Attack Requests (the Detected Attacks by Country map and the category table) and OWASP (the OWASP Web and OWASP API tables). The refresh interval is 1, 5, 10 or 30 seconds (default 1 second); the stream stops by itself after about 30 minutes and is restarted by turning the LIVE indicator off and on. In a cluster, each device is shown in a separate column, and the values are not summed.

Sections

The screen is opened through Left Monitor Panel → WAF-Protected vServices → vService → Live Stats; like the whole WAF screen of the vService, this tab also requires the WAF permission (accessing Live Stats).

The LIVE indicator at the top left of the screen stops and restarts the stream; the 1s, 5s, 10s, 30s chips next to it select the refresh interval. When the value of a card changes, the card glows with a short highlight and a direction arrow appears next to the value. The sections come from top to bottom in the following order:

Frontend

The section shows the instant status of the vService and its frontend; none of the cards shows the device as a whole (Frontend).

Card	What does it show?
Uptime	The uninterrupted running time of the vService
CPU	The instant CPU usage of the vService (%)
Memory Usage	The instant memory usage of the vService
WAF Attack Rate	Attack requests detected per second: the blocked requests (Blocked), the requests passed in Monitor Mode and the requests coming from a Teacher source are counted together
Current Sessions	The number of client sessions open at that moment; the tooltip contains the peak value and the defined upper limit, and the badge contains the number of requests in progress to the Backend Services at that moment
HTTP Request/s	The HTTP requests coming to the vService per second

WAF Inspection Distribution

It shows how the WAF concluded each request in six cards with a per-second rate; each request is counted in only one card (WAF Inspection Distribution).

Card	What does it show?
Whitelisted	Requests that never entered the WAF inspection; five reasons are counted (static content left outside the inspection with Do not WAF static contents, a Whitelist Condition match, the own AGS protocol traffic of the product, the CAPTCHA protocol traffic and the client evidence request sent by the Bot/DDoS verification page)
Clean	Requests that were inspected, were not blocked and did not fall into another card
Blocked	Requests whose score reached the blocking threshold and that were blocked
Monitor	Requests that were passed even though they reached the threshold, because the host group is in Monitor mode
Teacher	Requests that were passed even though they reached the threshold, because they came from a Teacher source
Learning	Requests that fell into a host group in Learning Mode or into the scope of Conditional Learning

The detailed meaning of the cards and the counting order: What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?

WAF Detected Attack Requests

It shows in two parts where the detected attacks come from and what type they are (WAF Detected Attack Requests).

Part	What does it show?
Detected Attacks by Country map	The distribution of the attacks across the source countries; as the density increases, the color turns from yellow to red. Since the color scale is logarithmic, the countries that send few attacks also stay visible; the map can be dragged and zoomed, and the sources that cannot be shown on the map are summarized as chips below it.
Category table	The attack categories with the Category, Requests/sec and Share columns; the categories that are not triggered at that moment stay in the list with a zero value. The sorting is changed by clicking a column header (default: descending by rate).

OWASP

The OWASP Web (OWASP Top 10 2021, A01:2021 … A10:2021) and OWASP API (OWASP API Security Top 10 2023, API1:2023 … API10:2023) tables come side by side, with the Requests/sec and Share columns. Where the attacks fall in the common classification of the industry is read here, for compliance reporting or for a security assessment (OWASP).

Points to Watch When Reading

• The Requests/sec column counts not requests but rule matches; since a request can fall into more than one rule and classification, the total of the rows may not equal the number of requests.
• The category and OWASP tables and the map count only the matches of the requests detected as attacks; the traffic in Learning mode and the hits of user-defined rules are not shown in these tables. The hits of user-defined rules are monitored on the Event Logs screen, and the traffic in Learning mode on the Analysis & Learning screen that reads the learning log; in Learning mode, no Event Logs record is written.
• The 30-second interval does not enlarge the values; it only changes the refresh frequency and the window over which the rate is smoothed. When the interval is changed, the stream is set up again and the rates read zero once.
• The stream is set up while the screen is open; after about 30 minutes, the server ends the stream, the LIVE indicator turns into the stop sign and the values stay as they were last read.

Scope and Limits

• Data is not stored; the history is monitored on the Dashboard (Which tabs does the WAF Dashboard have (Summary, Attack Analysis, Learning); why is the Learning tab not always visible?).
• There is no host group breakdown; the cards and the tables do not lead to another screen.
• When the counter reading fails, the values appear as zero; in a section that reads zero continuously, the traffic is verified with Event Logs (scope and limits).
• In a cluster setup, each device shows only the traffic that passes through itself; if the peer device cannot be reached, the column of that device stays empty.
• Live Stats on the LB side: What does the Live Stats screen show?

Common Misconceptions

• "Live Stats keeps updating as long as it stays open." The stream stops after about 30 minutes; it is restarted by turning the LIVE indicator off and on or by refreshing the page.
• "The total of the rates in the category table is the attack requests per second." The total is the number of rule matches; the attack request rate is on the WAF Attack Rate card.
• "In a cluster, the total of the two devices is shown." The values are shown in a separate column per device and are not summed.

How it is done in the documentation

• Live Stats · Screen Controls
• Live Stats · WAF Inspection Distribution
• Live Stats · WAF Detected Attack Requests
• Live Stats · Scope and Limits

Related questions

• What does the Live Stats screen show?
• What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?
• Which tabs does the WAF Dashboard have (Summary, Attack Analysis, Learning); why is the Learning tab not always visible?