Can I produce a report containing only certain attacks with the report filter?

Short answer

Yes. The Report Filter field in the WAF Report form is set to the Select position; the same condition builder as Log Filter in Event Logs opens, and at most 10 condition groups are defined with fields such as Signature, Category, OWASP Web, CWE, Client IP, Country, Path and Action, and Accept is clicked. The report is produced only from the attack records that match the filter; in attack-based fields, the attacks that do not match are also removed from the record. The filter is applied to the attack tables; the traffic charts continue to show all the traffic. On top of a filtered report, the Filtered Report badge and a summary of the filter appear; the PDF cover and the XLSX summary sheet also write the filter. Since a filtered report scans every record one by one, it is markedly slower than an unfiltered report. The scheduled e-mail report does not use this filter; an automatic filtered report is obtained only with the Report Attachment of advanced notifications.

Problem: The Report Should Focus on a Single Event

The impact of a signature, an attacker or an attack category within the period is to be reported; the remaining attacks of the period must not enter the report. An unfiltered WAF Report contains all the attack records in the period.

Solution: Two Methods

Your situation	Suitable method
Producing the filtered report now (HTML, PDF, XLSX)	Method 1: Report Filter
Receiving the filtered report by e-mail when a specific source exceeds a threshold	Method 2: Advanced notification report attachment

Method 1: Report Filter Recommended

• How it works The Report Filter is applied to every record while the report is produced; only the matching records and (in attack-based fields) only the matching attacks are counted. Since the ready hourly summaries cannot be used, the scan takes long.
• Where it is opened On the vService screen, Dashboard → For Detailed Analysis → WAF Report → Generate Report · WAF → Global WAF Report → Generate Report
• Requirement For the vService report, WAF permission (the vService WAF screen where the report is opened, including the Dashboard tab, is opened with this permission); for Global WAF Report, WAF permission and an account whose permission is not limited to specific vServices
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the report tab

On the Dashboard tab of the vService, the For Detailed Analysis → WAF Report shortcut is clicked; the WAF Report tab opens (how to access). For the global report, the WAF → Global WAF Report screen is opened (How is a WAF report created; which formats are available in the UI and by e-mail (HTML, PDF, XLSX)?).

2

Adım 2 Open the report form

Generate Report on the toolbar is clicked; the WAF Report form opens (Generate Report screen).

3

Adım 3 Select the type and the period

Report Type and Date are selected.

4

Adım 4 Turn on the filter

The Report Filter switch is moved from the No Restriction position to the Select position; the first condition row opens.

5

Adım 5 Define the conditions

The field, the operator and the value are selected. Examples:

Purpose	Condition
Report of a single signature	Taxonomy · Signature → Includes Any of → signature
Report of an attacker address	Network · Client IP → Equals to → address
Report of a network	Network · Client IP → IP/cidr match → network (e.g. 198.51.100.0/24)
Only the blocked ones	WAF · Action → Equals to → Blocking
SQL Injection attacks	Taxonomy · Category → Includes Any of → SQL Injection

Within a group, a condition is added with Add Condition, and a group with the + icon next to the first group; the connections are selected with the and / or switches (Can I write advanced filters in Event Logs with AND/OR, NOT, regex and JSONata expressions?). In Global WAF Report, there is also the Request · vService field.

6

Adım 6 Generate the report

Accept is clicked. The form selections, including the filter, are remembered per user.

Verification

1BadgeTR7 side

The toolbar of the HTML report is examined; in the PDF, the filter note on the cover, and in the XLSX, the summary sheet is checked.

ExpectedFiltered report (summary of the filter)

Method 2: Advanced Notification Report Attachment

• How it works When an Advanced Notifications trigger exceeds the threshold for a key (e.g. a single source IP), if Report Attachment is selected, a WAF report that covers the trigger window and is filtered by that key is attached to the e-mail (in the Global (all traffic) scope, no key filter is applied); with the Blocks count, the report is limited to only the blocked records.
• Where it is opened On the vService screen, WAF Management → Notifications card → pencil icon → Advanced Notifications
• Requirement At least one E-mail recipient; E-mail Settings (SMTP)
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Define a trigger

Steps for adding a trigger: How does scope (Global, Source IP, Source Subnet, Country, ASN, Host Header …) work in advanced notifications?

2

Adım 2 Select the report attachment

The Report Attachment switch of the trigger is turned on (when it is turned on, PDF comes selected) and PDF and/or XLSX is selected. The field is offered in the Global (all traffic), Source IP, Source Subnet, Country, ASN and Host Header scopes; in the Network Type Group and Network Type Category scopes, there is no report attachment.

3

Adım 3 Save

Edit is clicked.

Verification

1E-mail attachmentRecipient side

When the trigger runs, the attachment of the incoming e-mail is examined.

ExpectedA WAF report filtered by the triggering key (PDF and/or XLSX); unfiltered in the Global (all traffic) scope

Common Mistakes

• Thinking that the traffic charts are filtered as well. The filter narrows the attack tables; the total request and blocked request charts come from the traffic counters and are not affected by the filter.
• Forgetting the filter on for the next report. The form selections are remembered; for an unfiltered report, Report Filter is set back to No Restriction.
• Comparing the totals of the filtered and unfiltered reports. If a WAF Log Suppression Condition is defined, the suppressed records are counted in the unfiltered report and skipped in the filtered report.
• Thinking that the scheduled e-mail report will use the filter. Periodic Reporting is always produced unfiltered.
• Requesting a filtered report over a wide range. Since a filtered report scans every record, it takes long; for HTML, the 5-minute wait time can be exceeded. The range is narrowed.

How it is done in the documentation

• WAF Report · Report Filter
• WAF Report · The Production of the Report
• Notifications · Report Attachment

Related questions

• How do I filter logs by fields such as IP, country, ASN, path, signature, category, OWASP and CWE?
• Can I write advanced filters in Event Logs with AND/OR, NOT, regex and JSONata expressions?
• How is a WAF report created; which formats are available in the UI and by e-mail (HTML, PDF, XLSX)?