Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?

Short answer

Except for the requests that are blocked because their scan could not be completed within the time limit, the attack information (WAF info) carries the following top-level fields independently of the field selection: uid (the ID of the request), totalScore (the total attack score), action (block, monitor or fpc), wafTime (milliseconds) and the attacks list. In each attack in the list, id (the rule ID) is always present, and payload is present according to the Attack Payload in WAF Info setting. The other fields are selected from the Attack Details in WAF Info list on the SIEM & Attack Details card: Risk Level (score), Severity (severity), Attack Area (scope), Rule Monitor State (monitor), Attack Name (name), Description (desc), Category (category) and the list fields CWE (cwe), MITRE ATT&CK (mitre), CAPEC (capec), OWASP Web (owaspWeb), OWASP API (owaspApi), Target (target). The default selection is Risk Level, Attack Area and Rule Monitor State. A field that is not selected is not written at all; if a selected list field has no counterpart in the rule, null is sent. WAF Info Language (English or Türkçe; default English) affects only the attack name, the description and the severity text.

Fields

Option in the window	JSON key	Content	Language-dependent?
None (always)	`id`	Rule ID	-
None (depends on the setting)	`payload`	The matching content (Is the attack payload sent to the SIEM (Same as 'detailed log' / Always Send / Never Send)?)	-
Risk Level	`score`	The score of the attack	No
Severity	`severity`	The level label derived from the score of the attack: 50 and above Blacklist, 10 and above Structural, 8 and above Very high, 6 and above High, 4 and above Medium, 2 and above Low, below that Very low (Severity values)	Yes
Attack Area	`scope`	The request section in which the attack was caught (`path`, `query`, `header`, `form`, `json`, `xml`, `raw`)	No
Rule Monitor State	`monitor`	Whether the rule is in the Monitor state; if selected, always `true` or `false`	No
Attack Name	`name`	The name of the rule; for a user-defined rule, the rule's own name	Yes
Description	`desc`	The description of the rule	Yes
Category	`category`	The category of the rule	No
CWE (List)	`cwe`	CWE IDs or `null`	No
MITRE ATT&CK (List)	`mitre`	MITRE ATT&CK techniques or `null`	No
CAPEC (List)	`capec`	CAPEC IDs or `null`	No
OWASP Web (List)	`owaspWeb`	OWASP Top 10 (Web) items or `null`	No
OWASP API (List)	`owaspApi`	OWASP API Top 10 items or `null`	No
Target (List)	`target`	The target technology or components, or `null`	No

The top-level action is the overall verdict of the request: block means blocked, monitor means passed in Monitor mode or because of a rule monitored below the threshold, and fpc means recognized by Teacher. The per-attack monitor field, on the other hand, is the rule's own state.

Example (default fields, Same as 'detailed log', Detailed log on in the Path inspection):

json

{"uid":"AC10652A:D7236AA19B66:240002D","totalScore":8,"action":"block","attacks":[{"payload":"/cmd.exe","id":130005,"score":8,"monitor":false,"scope":"path"}],"wafTime":1.485}

In a request that is blocked in Blocking mode because its scan could not be completed within the time limit, the attack information does not apply the field selection; the uid and action keys are not present and the information is fixed: {"totalScore":100,"attacks":[{"id":369999,"score":100,"scope":"raw","severity":"high"}],"wafTime":2000}. In Learning or Monitor mode, in a Teacher or Conditional Learning request and while Fail-open is on, these requests are passed and the attack information stays empty ({}).

Configuring in TR7

On the WAF Management tab, the pencil icon of the SIEM & Attack Details card is clicked; in the SIEM & Attack Details window, the fields are checked in the Attack Details in WAF Info list, WAF Info Language is selected and Edit is clicked (SIEM & Attack Details Edit screen). The card sentence summarizes the selection (e.g. The attack detail carries 5 fields: Risk level, Attack area, Rule monitor state +2). The setting applies across the vService; it is valid in all host groups.

In WEB-CLI, the same fields are written with --wafInfoFields.N (values score, severity, scope, monitor, name, desc, category, cwe, mitre, capec, owaspWeb, owaspApi, target) and --wafInfoLang (en, tr) (WAF info content); .N replaces the existing field at that position.

The attack information goes to the SIEM according to the format of the log profile assigned to the vService: in the wafInfo field in CEF Format and TR7 JSON Format, and as the whole line in TR7 WAF Log (How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?). The same information can also be shown on the blocking page with the %WAFINFO variable (Which Smart Variables can I use on the blocking page (%UID, %SRCIP, %WAFSCORE, %WAFINFO …); is it safe to show attack details?).

Common Misconceptions

"A field that is not selected comes with an empty value." A field that is not selected is not written to the attack record at all; only the selected list fields come as null when there is no counterpart.
"WAF Info Language also translates the category names." The language affects only the Attack Name, Description and Severity texts.
"The per-attack monitor field is the verdict of the request." The verdict of the request is in the top-level action key.
"If all the fields are removed, the attack list comes empty." The attack record carries at least id (and payload, depending on the setting).

How it is done in the documentation

Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)? ​

Fields ​

Configuring in TR7 ​

Common Misconceptions ​

Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?

Fields

Configuring in TR7

Common Misconceptions