Can I see the WAF status of all vServices at a glance on the home page?
Short answer
Yes. The WAF tab of the home page, opened from the Home shortcut in the Header Bar, shows the total of all vServices whose WAF box is checked on a single screen; the tab requires WAF permission. Eight panels come in a fixed order: the Detected Attacks by Country map, WAF Blocked Requests, WAF Detected Attack Requests, WAF Inspection Distribution, Detected Attacks by Category, Detected Attacks by OWASP Top 10 (Web), Detected Attacks by OWASP API Top 10 and the vService Distribution table that lists the blocked requests per vService. In a cluster, the panels show the total of the two devices; a single device is selected with Source in the settings. The WAF Mode, OWASP Protection Level and Periodic Reporting values of each vService, on the other hand, are on the WAF-Protected vService List screen.
Screens
| Screen | Where it is opened | What it shows |
|---|---|---|
| Home → WAF | Header Bar → Home → WAF | The total charts of all WAF-protected vServices and the blocking table per vService |
| WAF-Protected vService List | WAF → WAF-Protected vService List | Per vService, Status, Name, IP, WAF Mode (e.g. 2 Blocking, 1 Learning, +Teacher), OWASP Protection Level, Periodic Reporting |
| Left Monitor Panel → WAF-Protected vServices | The WAF-Protected vServices category in the left panel | The primary metric per vService (default WAF Blocked Requests); when clicked, the WAF screen of the vService opens |
Home → WAF Panels
| Order | Panel | Content |
|---|---|---|
| 1 | Detected Attacks by Country | Map of the attacks by source country |
| 2 | WAF Blocked Requests | Blocked requests (Blocked) |
| 3 | WAF Detected Attack Requests | Detected attack requests (Blocked + Monitor + Teacher) |
| 4 | WAF Inspection Distribution | Distribution of Whitelisted, Clean, Blocked, Monitor, Teacher, Learning |
| 5 | Detected Attacks by Category | Breakdown by attack category |
| 6 | Detected Attacks by OWASP Top 10 (Web) | OWASP Top 10 (Web) breakdown |
| 7 | Detected Attacks by OWASP API Top 10 | OWASP API Top 10 breakdown |
| 8 | vService Distribution | WAF Blocked Requests, one row per vService |
- The panels are the total of the vServices whose WAF box is checked; if there is no WAF-protected vService at all, the tab opens but the panels stay empty (scope and limits).
- With Add Visualization, the vService Distribution table for WAF Detected Attack Requests and the Learning Log Sampling and Learning Discovery Rate panels can be added.
- The table rows do not lead to the vService screen; the details of a single vService are opened from the Left Monitor Panel (Which tabs does the WAF Dashboard have (Summary, Attack Analysis, Learning); why is the Learning tab not always visible?).
- In a cluster setup, the panels are the total of the two devices; a single device is selected with Source in the settings window.
Common Misconceptions
- "The vService screen is reached from the Home → WAF tab." The table rows do not carry links; the vService screen is opened from the Left Monitor Panel or from the WAF-Protected vService List preview.
- "The Home → WAF tab shows the WAF mode and the protection level." This information is in the WAF Mode and OWASP Protection Level columns of the WAF-Protected vService List screen.
- "vServices without WAF are also included in the totals." Only the vServices whose WAF box is checked are counted.
How it is done in the documentation
