Can I receive reports regularly by e-mail; at what times are they sent?

Short answer

Yes. In the Periodic Reporting card on the WAF Management tab of the vService screen, E-mail Report is turned on; E-mail Addresses, E-mail Report Content (pdf, xlsx or both) and E-mail Frequency (Daily, Weekly, Monthly, Annual; more than one can be selected) are set and Edit is clicked. The sending is done according to the local time of the device and each report covers the previous full period: Daily every day at 07:30 the previous day, Weekly every Monday at 03:30 the previous week (Monday–Sunday), Monthly on the 1st of every month at 05:30 the previous month, Annual every 1 January at 06:30 the previous year. In a cluster setup, only device number 1 of the cluster sends the e-mail; the report covers the records of both devices. For the sending, E-mail Settings (SMTP) must be defined. The scheduled report does not use the filter, row limit and language selections on the WAF Report screen; it is produced in the default language of the device. The report that covers all vServices is scheduled from the Periodic Reporting tab of the Global WAF Report screen.

Problem: The WAF Report Is Taken Manually Every Period

The security team or the management wants to receive the WAF report regularly every week or every month. On the WAF Report screen, the report is produced manually each time; for regular sending, the report needs to be scheduled.

Sending Times

Option	Sending time (local time of the device)	Range covered
Daily	Every day at 07:30	The previous day (00:00–23:59)
Weekly	Every Monday at 03:30	The previous week (Monday–Sunday)
Monthly	The 1st of every month at 05:30	The previous month
Annual	Every 1 January at 06:30	The previous year

If more than one period is selected, a separate e-mail is sent for each period. The subject of the e-mail is in the [TR7-NOTIFIER] <vService-name> daily WAF report pattern; the attachment files carry the names waf_report_<vService-name>_<start>-<end>.pdf and .xlsx (Periodic Reporting · Edit).

Solution: Three Methods

Your situation	Suitable method
Scheduling the report of a single vService from the interface	Method 1: Periodic Reporting card
Making the setting from the command line or on many vServices at once	Method 2: WEB-CLI
Scheduling the single report that covers all vServices	Method 3: Global WAF Report

Method 1: Periodic Reporting Card Recommended

• How it worksPeriodic Reporting produces the report as PDF and/or XLSX at the end of each selected period and sends it as an attachment to the defined addresses; the report is not stored on the device.
• Where it is opened On the vService screen, WAF Management → Learning & Reporting → Periodic Reporting card → pencil icon
• Requirement Modify permission in the WAF area; E-mail Settings (SMTP) on the Settings → General Settings → Notification Management screen
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Check the e-mail server

If E-mail Settings is not defined on the Settings → General Settings → Notification Management screen, the SMTP server is defined. If it is not defined, the report cannot be sent and no separate warning appears on the WAF screen.

2

Adım 2 Open the WAF Management tab

The Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab is opened.

3

Adım 3 Open the Periodic Reporting window

The pencil icon at the top right of the Periodic Reporting card in the Learning & Reporting row is clicked; the Periodic Reporting window opens (Periodic Reporting Edit screen).

4

Adım 4 Turn on the e-mail report

The E-mail Report switch is turned on (off by default); three fields appear below it. When the switch is turned off, the fields are hidden but their values are preserved.

5

Adım 5 Enter the recipients

The recipients are entered line by line in the E-mail Addresses field (e.g. guvenlik@example.com).

6

Adım 6 Select the format and the period

In the E-mail Report Content field, pdf, xlsx or both are checked; if both are selected, two attachments are put into the e-mail. In the E-mail Frequency field, the periods are checked. If there is no saved selection, both fields open with all options checked; at least one option must remain in each field.

7

Adım 7 Save

Edit is clicked; there is no separate deployment step, and the setting becomes valid at the next sending time. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Card sentenceTR7 side

The summary sentence on the Periodic Reporting card is examined; the selected periods also appear in the Periodic Reporting column of the WAF-Protected vService List screen.

ExpectedThe WAF report is e-mailed Weekly to 1 addresses (PDF)

If no address is entered, the card shows the "E-mail reporting is on but no address is defined" warning.

2E-mailRecipient side

After the first sending time, the inbox of the recipient is examined.

Expected[TR7-NOTIFIER] vService name weekly WAF report + PDF attachment

Method 2: WEB-CLI

• How it works The waf options update command in WEB-CLI writes the same four fields; with update-many, the same setting is applied to multiple vServices (bulk update).
• Where it is opened WEB-CLI → waf options show · waf options update
• Requirement WEB-CLI access and modify permission in the WAF area; SMTP defined
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 See the existing setting

waf options show poolId <vService>

The emailAddresses, emailFileTypes and emailFrequency lines in the output show the existing lists. In these fields, the .N index replaces the existing item at that position; the new item is written to the first empty index.

2

Adım 2 Turn on the report and write the fields

Example while the lists are empty (weekly, PDF, single recipient):

waf options update poolId <vService> --emailReport true --emailAddresses.0 guvenlik@example.com --emailFileTypes.0 pdf --emailFrequency.0 weekly

To add a second recipient or period, the first empty index is used (e.g. --emailAddresses.1 if there is one address in the list). The --emailFileTypes values are pdf and xlsx, and the --emailFrequency values are daily, weekly, monthly and annual.

Verification

1RecordTR7 side

The setting is displayed again.

Command: waf options show poolId <vService>

ExpectedemailReport true · emailFrequency weekly

Method 3: Global WAF Report

• How it works The report that covers all WAF-protected vServices is sent at the same times and with the same periods; the setting is single across the device.
• Where it is openedWAF → Global WAF Report → Periodic Reporting tab
• Requirement WAF permission (full permission for editing); an account whose permission is not restricted to specific vServices; SMTP defined
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Periodic Reporting tab

On the WAF → Global WAF Report screen, the Periodic Reporting tab is selected.

2

Adım 2 Open the edit tab

Edit is clicked; a closable Edit tab opens on the same screen (Periodic Reporting Edit screen).

3

Adım 3 Fill in the fields

E-mail Report is turned on; E-mail Addresses, E-mail Report Content and E-mail Frequency are filled in as in Method 1. The global report is not sent unless at least one address is defined.

4

Adım 4 Save

Save is clicked.

Verification

1Setting summaryTR7 side

The summary lines on the Periodic Reporting tab are examined.

ExpectedE-mail Report on; the addresses, the content and the periods are listed

Common Mistakes

• Expecting sending without the SMTP setting. If E-mail Settings is not defined, the report cannot be sent and the WAF screen does not warn about this.
• Thinking that the selections on the screen are also applied to the scheduled report. The scheduled report does not use the Report Filter, row limit and Report Language selections; it is produced with the standard scope and in the default language of the device (Localization). For a filtered automatic report, the report attachment in the advanced notifications is used (Can I produce a report containing only certain attacks with the report filter?).
• Expecting e-mail from both devices in a cluster. Only device number 1 of the cluster sends the report; the report combines the records of both devices.
• Leaving all periods checked. While there is no saved selection, the form opens with the four periods checked; unless only the desired periods are left, a separate e-mail arrives for each period.
• Overwriting the existing address with .0 in WEB-CLI. --emailAddresses.0 replaces the first address in the list; the first empty index is first found with waf options show.

How it is done in the documentation

• Periodic Reporting · The Periodic Reporting Edit Screen
• Periodic Reporting · E-mail Frequency
• Global WAF Report · The Periodic Reporting Edit Screen
• WEB-CLI · waf options · The E-mail Report

Related questions

• How is a WAF report created; which formats are available in the UI and by e-mail (HTML, PDF, XLSX)?
• Can I get a single WAF report for the whole device (Global WAF Report)?
• Can I receive reports regularly by e-mail?