FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

Can I see how long a request spent in the WAF (WAF Time)? ​

Short answer

Yes, for requests for which an Event Logs record is written. In Event Logs, the record is clicked and the WAF Time row on the Request & Location tab of the preview is read; the value is in milliseconds. The distribution over a period is in the WAF Time chart in the Traffic view of WAF Report (the <0.1ms, 0.1ms-0.5ms, 0.5ms-1ms, 1-10ms, 10-100ms, 100-1000ms and >1s ranges). The same value is sent in the attack information going to SIEM with the wafTime key. Since clean requests are not written to the record, WAF Time is seen only for requests that have a record; Dashboard and Live Stats do not show the WAF time per request. What the value covers is explained on the What exactly does the WAF Time value measure? page.

Problem: The Per-Request Duration of the WAF Inspection Is to Be Seen ​

When slowness is reported in an application or the protection level is increased, it is necessary to know how long the WAF inspection takes per request. TR7 keeps this duration in every Event Logs record as WAF Time; no separate duration measurement is shown for requests whose record is not written (clean ones or those in Learning mode).

Solution: Three Methods ​

Your situationSuitable method
The duration of a single requestMethod 1: Event Logs
The distribution of the durations in a periodMethod 2: WAF Report → Traffic
Keeping the duration in SIEM and examining it with one's own analysis toolMethod 3: Sending to SIEM
  • How it works In the preview of every record, the Request & Location tab shows the time the request spent in the WAF inspection.
  • Where it is openedLeft Monitor Panel → WAF-Protected vServices → vService → Event Logs
  • Requirement WAF permission; the Event Logs record of the request having been written
  • vService type HTTP

Step-by-Step Configuration ​

1
Adım 1 Open the Event Logs screen

In the Left Monitor Panel, the vService is clicked in the WAF-Protected vServices category and the Event Logs tab is selected (access to Event Logs). If a specific request is searched for, its ID is entered in the Request Unique ID field in the server filter (How do I find a specific request by its Request Unique ID?).

2
Adım 2 Open the record

The record is clicked in the list; the preview opens on the right.

3
Adım 3 Switch to the Request & Location tab

In the preview, the Request & Location tab is selected and the WAF Time row is read.

Verification ​

1PreviewTR7 side

The WAF Time row on the Request & Location tab is examined.

ExpectedA duration in milliseconds

Method 2: WAF Report → Traffic ​

  • How it worksWAF Report groups the records in the selected period by duration ranges; the Traffic view of the HTML report contains the WAF Time chart and table.
  • Where it is opened On the vService screen, Dashboard → For Detailed Analysis → WAF Report
  • Requirement WAF permission (the vService WAF screen on which the report is opened, including the Dashboard tab, opens with this permission)
  • vService type HTTP

Step-by-Step Configuration ​

1
Adım 1 Open the WAF Report tab

On the Dashboard tab of the vService screen, the For Detailed Analysis → WAF Report shortcut on the toolbar is clicked; a closable WAF Report tab opens on the same screen (how to access).

2
Adım 2 Open the report form

The Generate Report button is clicked; the WAF Report window opens (Generate Report screen).

3
Adım 3 Select the type and the period

Report Type is left as html, and the period is selected in the Date field (default the last 1 day).

4
Adım 4 Generate the report

Accept is clicked; the report is displayed on the same tab.

5
Adım 5 Switch to the Traffic view

The Traffic tab of the report is opened and the WAF Time chart is read.

Verification ​

1ReportTR7 side

The WAF Time chart in the Traffic view is examined.

Expected<0.1ms · 0.1ms-0.5ms · 0.5ms-1ms · 1-10ms · 10-100ms · 100-1000ms · >1s distribution

Method 3: Sending to SIEM ​

  • How it works In requests in which an attack is found, the wafTime key at the top level of the attack information carries the duration in milliseconds; the log profile sends this information to SIEM with every line.
  • Where it is openedLoad Balancer → Profiles → Logs; in the edit form of the vService, Details → LOG
  • Requirement Modify permission in the Load Balancer area (the Logs profile and the vService form are on the Load Balancer screens); a Syslog receiver (SIEM); as the Line Format, a format that carries the attack information (CEF Format, TR7 JSON Format or TR7 WAF Log)
  • vService type HTTP

Step-by-Step Configuration ​

1
Adım 1 Create the log profile and bind it to the vService

The steps for creating the profile and binding it to the vService: How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?

2
Adım 2 Read the field in SIEM

In SIEM, the wafTime field of the attack information is queried (inside wafInfo in the CEF and TR7 JSON formats, at the top level of the line in the TR7 WAF Log format).

Verification ​

1SIEM recordSIEM side

The line of a request that contains an attack is examined.

Expected"wafTime":1.485

Common Mistakes ​

  • Looking for WAF Time for every request. The duration is kept only for requests for which an Event Logs record is written; it is not shown for clean requests, traffic in Learning mode and requests that never enter WAF.
  • Thinking that WAF Time is the total waiting time of the user. The value is only the duration of the WAF inspection; waiting for the body, the Backend Service response and network times are not included (What exactly does the WAF Time value measure?).
  • Looking for the per-request duration in Live Stats. Live Stats shows rates; the per-request WAF duration is found only in the records and in the report.

How it is done in the documentation

Related questions