Exporting insights

The Threat Protection API provides an endpoint to pull insight events (aka mitigations) from your WAF configured proxies. This includes both blocked and logged WAF events, as well as any rate limiting based blocks.

A second endpoint will be coming soon where you can pull blocked DDoS attacks in aggregates.

WAF Events

The HTTP Security Events endpoint provides a stream of WAF and Rate Limiting events for a given tenant ID. Provide the required tenant ID via the filter[tenantId] query parameter. The same events are represented in the Threat Protection portal under the dashboard (WAF View and Rate Limiting view respectively).

By default, if the filter[eventType] query parameter is not specified, all WAF_EVENT and APP_DDOS_ATTACK events will be provided in the response in the order that they occur.

Sample Request

Suppose we want to get events with the following criteria:

• Get one WAF_EVENT event
• From all proxies under tenant ID a767ec76-9ba2-439e-86d6-2257f46bf331
• Starting at cursor 3fa85f64-5717-4562-b3fc-2c963f66afa6

Request

curl https://portal.baffinbay.com/api/v2/insight/http-security-events?filter[tenantId]=0f4f9899-5339-4be8-b507-f6c5b00f6d63&page[after]=3fa85f64-5717-4562-b3fc-2c963f66afa6&page[size]=1&filter[eventType]=WAF_EVENT \
    -H 'Authorization: Bearer {auth_token}'

Response

{
  "data": [
    {
      "type": "WAF_EVENT",
      "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "attributes": {
        "timestamp": "2024-09-24T11:17:38.061Z",
        "rules": [
          {
            "modSecId": 930130,
            "name": "Restricted File Access Attempt",
            "matchedData" : {
              "status": "DISABLED",
              "value" : null
            }
          }
        ],
        "supportId": "3fa85f6457174562b3fc2c963f66afa6",
        "action": "BLOCKED",
        "tpc": "SIN",
        "destinationIp": "192.66.212.136",
        "source": {
          "countryCode": "SE",
          "ip": "78.66.22.136",
          "port": 1234
        },
        "request": {
          "method": "GET",
          "path": "/",
          "headers": [
            "Accept: */*",
            "Host: example.com",
            "Connection: keep-alive"
          ],
          "messageHeader": "GET / HTTP/1.1\nAccept: */*\nUser-Agent: tester/1.1\nHost: example.com\nConnection: keep-alive",
          "statusCode": 403
        }
      },
      "relationships": {
        "belongsTo": {
          "data": {
            "type": "TENANT",
            "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
          }
        }
      }
    }
  ],
  "links": {
    "self": "/api/v2/insight/http-security-events?page[after]=3fa85f64-5717-4562-b3fc-2c963f66afa6&page[size]=10",
    "first": "/api/v2/insight/http-security-events?page[size]=10",
    "next": "/api/v2/insight/http-security-events?page[after]=3fa85f64-5717-4562-b3fc-2c963f66afa6&page[size]=10"
  }
}