Can I receive a notification when the attack count exceeds a certain threshold?

Short answer

Yes, in two ways; both are set in the Notifications card on the vService's WAF Management tab. Block Threshold (per sec) and Detected Attack Threshold (per sec) are per-second thresholds: when the switch is turned on, the value comes as 10 (at least 1); when the blocked requests or the detected attack requests (blocked + Monitor + Teacher) per second exceed this value, a notification is sent, and when the rate falls below 80% of the threshold, a back to normal notification arrives. There is no general switch that turns on notifications; each threshold whose switch is turned on and whose value is entered works on its own. Advanced Notifications, on the other hand, counts over a time window and a scope (e.g. 100 blocks in 5 minutes from a single source IP). The channels are selected in the same window: E-mail, SMS, SNMP Notification and UI Notification (on by default). The notifications sent are seen on the Notification Logs screen with the name WAF Attack Rate or Advanced WAF Notification.

Problem: An Increase in Attacks Goes Unnoticed

In an attack wave, the blocking or detection rate rises within a few minutes; unless the Dashboard is looked at, this increase goes unnoticed. When the rate exceeds a certain value, the relevant team needs to be informed.

Solution: Three Methods

The per-second thresholds and the advanced notifications can be used together in the same window.

Your situation	Suitable method
Getting informed when the per-second blocking or detection rate rises across the vService	Method 1: Per-second thresholds
Getting informed when a certain number is exceeded within a certain time for a single source, network, country or host	Method 2: Advanced Notifications
Defining the thresholds from the command line	Method 3: WEB-CLI

Method 1: Per-Second Thresholds Recommended

• How it works Each device monitors the per-second rate in its own traffic: Block Threshold (per sec) counts the blocked requests, and Detected Attack Threshold (per sec) counts the total of the attack requests that are blocked, passed in Monitor mode and recognized by Teacher. When the rate exceeds the threshold, an alarm notification is sent, and when it falls below 80% of the threshold, a return-to-normal notification is sent.
• Where it is opened On the vService screen, WAF Management → Learning & Reporting → Notifications card → pencil icon
• Requirement Modify permission in the WAF area; for e-mail, E-mail Settings (SMTP), and for SNMP, the SNMP Settings target in Notification Management
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the WAF Management tab

The Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab is opened.

2

Adım 2 Open the Notifications window

The pencil icon at the top right of the Notifications card in the Learning & Reporting row is clicked; the Notifications window opens (Notifications Edit screen).

3

Adım 3 Turn on the threshold and enter the value

The Block Threshold (per sec) or Detected Attack Threshold (per sec) switch is turned on; the field comes with the value 10, and the desired value (at least 1) is entered. The two thresholds can also be used together. Since the detection threshold also counts the attacks in Monitor mode and the ones passed by Teacher, it is triggered before the blocking threshold (What is the difference between "Blocks" and "Detections" in a notification?).

4

Adım 4 Select the channels

The recipients and the channels are selected: addresses are added to the E-mail list and telephone numbers to the SMS list; the SNMP Notification (off by default) and UI Notification (on by default) switches are set (What are the notification channels (UI, e-mail, SMS, SNMP)?).

5

Adım 5 Save

Edit is clicked; there is no separate deployment step. In a cluster setup, the setting is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually. Each device evaluates its own traffic separately.

Verification

1Card sentenceTR7 side

The sentence and the channel badges on the Notifications card are examined.

ExpectedA notification is sent when 20 blocks per second is exceeded

2Notification recordTR7 side

When the threshold is exceeded, the record is examined with the Notification Log link on the lower strip of the card or on the Notification Logs screen.

ExpectedWAF block rate is high for vService "…": 28/s > 20/s

Method 2: Advanced Notifications

• How it works Each trigger carries a scope (e.g. Source IP, Country, Host Header), a count (Blocks or Detections), a window (30 seconds – 1 hour) and a threshold (Threshold); each key of the scope (each IP, each country …) is counted separately and a notification is sent for the key that exceeds the threshold within the window. At most 6 triggers can be defined.
• Where it is opened The same Notifications window → Advanced Notifications
• Requirement As in Method 1
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Notifications window

On the WAF Management tab, the pencil icon of the Notifications card is clicked.

2

Adım 2 Turn on the advanced notifications

The Advanced Notifications switch is turned on; the first trigger comes with the Country, Blocks, 5 minutes and 100 values. Another trigger is added with + (Add trigger) next to the title.

3

Adım 3 Define the trigger

Example, a single source IP being blocked more than 100 times in 5 minutes: Scope = Source IP, Count = Blocks, Window = 5 minutes, Threshold = 100. The details of the scopes and the base thresholds: How does scope (Global, Source IP, Source Subnet, Country, ASN, Host Header …) work in advanced notifications?

4

Adım 4 Select the channels

The channels in Method 1 are also used for the advanced triggers; if needed, at least one E-mail address is added.

5

Adım 5 Save

Edit is clicked.

Verification

1Card sentenceTR7 side

The sentence on the Notifications card is examined.

ExpectedA notification is sent when one Source IP exceeds 100 blocks in 5 minute(s)

Method 3: WEB-CLI

• How it works The waf options update command writes the thresholds and the channels (notifications).
• Where it is opened WEB-CLI → waf options show · waf options update
• Requirement WEB-CLI access and modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 See the existing channels

waf options show poolId <vService>

The notifyEmail and notifySms lines in the output show the existing recipients. In these lists, the .N index replaces the existing recipient at that position; the new recipient is written to the first empty index.

2

Adım 2 Write the threshold and the channel

Example while there is no recipient in the list:

waf options update poolId <vService> --notifyBlockRate 20 --notifyEmail.0 guvenlik@example.com --notifyUi true

The detection threshold is written with --notifyAttackRate. The advanced triggers are defined with the --advancedNotifications.N.scope, .countType, .window.val, .window.unit and .limit fields (advanced notifications).

Verification

1RecordTR7 side

The setting is displayed again.

Command: waf options show poolId <vService>

ExpectednotifyBlockRate 20

Common Mistakes

• Expecting a blocking threshold in Monitor mode. In a host group in Monitor mode, the request is not blocked; the blocking rate does not rise. During the monitoring period, Detected Attack Threshold (per sec) or the Detections count is used.
• Entering a threshold without selecting a channel. If a threshold is entered and E-mail, SMS and SNMP Notification are left empty, the notification appears only in the interface (if UI Notification is on) and in Notification Logs.
• Expecting an e-mail or a trap without an SMTP or SNMP target. The infrastructure is defined on the Notification Management screen; the recipients, on the other hand, come from the WAF's own form.
• Expecting SMS at night. If Mute Night Notifications is on in Notification Management, SMS is not sent between 22:00 and 08:00; e-mail, SNMP and interface notifications continue to be sent.
• Overwriting the existing recipient with --notifyEmail.0 in WEB-CLI. .0 replaces the first recipient in the list; the first empty index is first found with waf options show.

How it is done in the documentation

• Notifications · The Notifications Edit Screen
• Notifications · Block Threshold (per sec)
• Notifications · Advanced Notifications
• WEB-CLI · waf options · The Notifications

Related questions

• What are the notification channels (UI, e-mail, SMS, SNMP)?
• What is the difference between "Blocks" and "Detections" in a notification?
• Can I define advanced notifications based on source IP, country, ASN or subnet (Advanced Notifications)?