How do I filter logs by fields such as IP, country, ASN, path, signature, category, OWASP and CWE?

Short answer

Event Logs has two filter layers. The filter strip works instantly on the fetched records: on tabs such as Client IP, Country, ASN, Path, Signature, Category, OWASP Web and CWE, the values are listed with the number of records or attacks; selections in the same tab are combined with or, selections in different tabs with and, and attack-based tabs also narrow the attack list of the record. Log Filter, on the other hand, determines which records are fetched on the server: in the server filter tab at the beginning of the strip, conditions are written for the fields in the Network, Request, WAF and Taxonomy groups with Add Advanced Filter, and Save & Get Logs is clicked; the reading continues backwards until Line Limit is filled. If the record searched for is outside the fetched rows, Log Filter is used; to narrow the fetched rows, the filter strip is used.

Problem: Records Are to Be Examined by a Specific Source or Attack Type

By default, Event Logs fetches the newest 1,000 records of the last 7 days. To examine the requests coming from a specific country, network or page, or a specific signature or attack category, the records need to be filtered. If filtering is done only on the fetched records, older records that are outside the row limit do not appear in the result.

Solution: Two Methods

The two layers can be used together: first the records are fetched with the scope narrowed by Log Filter, then they are examined with the filter strip.

Your situation	Suitable method
I want to quickly narrow the records on the screen and see the value distribution	Method 1: Filter strip
I want to fetch only the records that match a condition without hitting the row limit	Method 2: Log Filter

Method 1: Filter Strip Recommended

• How it works The filter strip filters the fetched records without going to the server. The number in the tab title gives the number of different values in that field; the number next to a value gives the number of records in record-based tabs and the number of attacks in attack-based tabs; the first 60 values are listed, and the list grows as it is scrolled down.
• Where it is openedLeft Monitor Panel → WAF-Protected vServices → vService → Event Logs → the strip above the table
• Requirement WAF permission
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Event Logs screen

In the Left Monitor Panel, the vService is clicked in the WAF-Protected vServices category and the Event Logs tab is selected (access to Event Logs). The strip is open when the screen opens; if it is closed, it is opened with the Filter button on the toolbar.

2

Adım 2 Open the tab

The tab of the field to be filtered is clicked on the strip (e.g. Country); the values are listed with their numbers, from largest to smallest. The tabs and their scopes:

Scope	Tabs
Record (the selection is applied to the whole record)	Client IP, Method, Country, IP Tags, ASN, Path, Host, User Agent, Browser, Operating System, Device Type, Browser Version, Protocol, Blacklist, Learn Status, X-Forwarded-For
Attack (the selection also narrows the attack list of the record)	Signature, Scope, Category, OWASP Web, OWASP API, CWE, CAPEC, MITRE ATT&CK, Target, Severity

The User Agent and Protocol tabs are hidden by default; they are added with the + button at the end of the strip. The IP Tags tab shows the IP tags that match the client address, the Blacklist tab shows the current blacklist status of the address, and the Learn Status tab shows the teaching status of the record (all, some or none taught).

3

Adım 3 Select the value

The value is clicked. On the Method, Country, User Agent, Browser, Operating System, Device Type, Browser Version, Protocol and Blacklist tabs a single value is selected; on the others, multiple values are selected. If the value does not appear in the list, it is typed in the search box at the top right of the table.

4

Adım 4 Combine with other tabs

If needed, a selection is also made on another tab. Selections in the same tab are combined with or, selections in different tabs with and; the numbers are recalculated at every selection (combining of the selections). The selections are stored per user and are preserved at the next opening.

To search for text in the table cells, the Search, RegExp Search and Column Based Search boxes on the toolbar can also be used; these also work only on the fetched rows.

Verification

1List and previewTR7 side

The Page Information line below the table and the Attacks tab in the preview of a record are examined.

ExpectedShowing … records and the filter summary; with an attack-based selection, only the attacks that match the selection

Method 2: Log Filter

• How it worksLog Filter works on the server side: only the records that match the condition are fetched, and the reading continues backwards until Line Limit is filled. Text comparisons are not case-sensitive. Attack-based fields (the Taxonomy group and WAF · Severity) remove the non-matching attacks from the record.
• Where it is openedEvent Logs → the server filter tab at the beginning of the filter strip → Log Filter
• Requirement WAF permission
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the server filter tab

On the Event Logs screen, the fixed tab at the beginning of the filter strip is clicked; its title shows the selected time range (e.g. Last 7 day(s)). The tab contains the Date Range, Line Limit, Request Unique ID and Log Filter fields.

2

Adım 2 Add an advanced filter

The Add Advanced Filter button in the Log Filter row is clicked; the first condition row opens.

3

Adım 3 Define the condition

The field is selected from the field list, followed by the operator and the value. The fields are in four groups:

Group	Fields
Network	Client IP, Country, City, ASN
Request	Method, Host, Path, Query, User Agent, Request header (by entering the header name)
WAF	WAF score, Monitor only, Blacklist, Learn status, Severity, Action
Taxonomy	Category, CWE, MITRE ATT&CK, CAPEC, OWASP Web, OWASP API, Target, Signature, Attack scope

Example: Network · ASN → Any of → ASN numbers; Taxonomy · Category → Includes Any of → category. Operators, grouping and JSONata expressions: Can I write advanced filters in Event Logs with AND/OR, NOT, regex and JSONata expressions?

4

Adım 4 Set the scope

If the records searched for are older, Date Range is widened in the same tab; Line Limit is entered between 1 and 20,000 (default 1,000).

5

Adım 5 Save and list

Save & Get Logs is clicked; the button becomes enabled only when a change is made in the tab. The filter, the time range and the row limit are stored per user; at its next opening, the screen fetches with the same scope.

Verification

1Tab titleTR7 side

The title of the server filter tab is examined; the title shows the number of defined conditions.

ExpectedLast 7 day(s) - 2 advanced filter(s)

To remove the filter, Remove Filter is clicked in the tab and the change is saved with Save & Get Logs, or the summary chip below the strip is closed.

Common Mistakes

• Thinking that the filter strip brings older records. The strip filters only the fetched records; for records outside the row limit, Log Filter is used or Date Range is changed.
• Thinking that a record-based tab narrows the attacks. A Path or Client IP selection does not change the attack list of the record; only attack-based tabs narrow the attacks.
• Forgetting the scope of the teaching operation with an attack-based selection. Allow / Teach works on the visible state of the list; if there is an attack-based selection, only the attacks that match the selection are taught (Can I Allow / Teach several logs at once; are attacks hidden by the filter taught as well?).
• Forgetting a filter left over from the previous session. The strip selections and the server filter are stored per user; if the list shows fewer records than expected, the summary chips below the strip are examined.
• Thinking that the Blacklist tab shows the status at the time of the record. The Blacklist value is not read from the record; it is calculated according to the current blacklist status of the address.

The same condition builder is also used in the WAF report: Can I produce a report containing only certain attacks with the report filter?

How it is done in the documentation

• Event Logs · The Filterable Information
• Event Logs · The Combining of the Selections
• Event Logs · Log Filter
• Event Logs · Line Limit

Related questions

• Can I write advanced filters in Event Logs with AND/OR, NOT, regex and JSONata expressions?
• Can I Allow / Teach several logs at once; are attacks hidden by the filter taught as well?
• How do I find the requests of a specific client IP in the logs?