Querying Attack Logs

Function

This API is used to query attack logs.

URI

GET /v1/{project_id}/cfw/logs/attack

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Project ID, which can be obtained by calling an API or from the console. For details, see `Obtaining a Project ID <cfw_02_0015>`.

**Table 2** Query Parameters
Parameter	Mandatory	Type	Description
start_time	Yes	Long	Start time, in milliseconds. The value is a timestamp, for example, 1718936272648.
end_time	Yes	Long	End time, in milliseconds. The value is a timestamp, for example, 1718936272648.
src_ip	No	String	Source IP address.
src_port	No	Integer	Source port.
dst_ip	No	String	Destination IP address.
dst_port	No	Integer	Destination port.
protocol	No	String	Protocol type. Its value can be TCP, UDP, ICMP, or ICMPv6.
app	No	String	Rule application type. Its value can be HTTP, HTTPS, TLS1, DNS, SSH, MYSQL, SMTP, RDP, RDPS, VNC, POP3, IMAP4, SMTPS, POP3S, FTPS, or ANY.
log_id	No	String	Document ID. For the first page, its value is null. For other pages, its value can be the log_id of the last record in the last query.
next_date	No	Long	Next date. For the first page, its value is null. For other pages, its value can be the event_time of the last record in the last query.
offset	No	Integer	Offset, which specifies the start position of the record to be returned. The value must be a number greater than 0. For the first page, its value is null. For other pages, its value is not null.
limit	Yes	Integer	Number of records displayed on each page. The value ranges from 1 to 1024.
fw_instance_id	Yes	String	Firewall ID, which can be obtained by referring to `Obtaining a Firewall ID <cfw_02_0028>`.
action	No	String	Action. Its value can be permit or deny.
direction	No	String	Direction. Its value can be in2out or out2in.
attack_type	No	String	Intrusion event type.
attack_rule	No	String	Intrusion event rule.
level	No	String	Threat level. Its value can be CRITICAL, HIGH, MEDIUM, or LOW.
enterprise_project_id	No	String	Enterprise project ID, which is the ID of a project planned based on organizations. You can obtain the enterprise project ID by referring to `Obtaining an Enterprise Project ID <cfw_02_0027>`. If the enterprise project function is not enabled, the value is 0.
dst_host	No	String	Destination host.
log_type	No	String	Log type. Its value can be internet, vpc, or nat.
attack_rule_id	No	String	Intrusion event ID.
src_region_name	No	String	Source region name.
dst_region_name	No	String	Destination region name.
src_province_name	No	String	Source province name.
dst_province_name	No	String	Destination province name.
src_city_name	No	String	Source city name.
dst_city_name	No	String	Destination city name.

Request Parameters

**Table 3** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	User token. You can obtain the token by referring to `Obtaining a User Token <cfw_02_0029>`.

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
data	`data <listattacklogs__response_data>` object	Return value for querying attack logs.

**Table 5** data
Parameter	Type	Description
total	Integer	Total number of returned attack data records.
limit	Integer	Number of records displayed on each page. The value ranges from 1 to 1024.
records	Array of `records <listattacklogs__response_records>` objects	Attack log list.

**Table 6** records
Parameter	Type	Description
direction	String	Direction. Its value can be in2out or out2in.
action	String	Action. Its value can be permit or deny.
event_time	Long	Event time, in milliseconds. The value is a timestamp, for example, 1718936272648.
attack_type	String	Attack type.
attack_rule	String	Attack rule.
level	String	Threat level. Its value can be CRITICAL, HIGH, MEDIUM, or LOW.
source	String	Source.
packet_length	Long	Packet length.
attack_rule_id	String	Attack rule ID.
hit_time	Long	Hit time, in milliseconds. The value is a timestamp, for example, 1718936272648.
log_id	String	Log ID.
src_ip	String	Source IP address.
src_port	Integer	Source port.
dst_ip	String	Destination IP address.
dst_port	Integer	Destination port.
protocol	String	Protocol type. Its value can be TCP, UDP, ICMP, or ICMPv6.
packet	String	Attack log packet.
app	String	Rule application type. Its value can be HTTP, HTTPS, TLS1, DNS, SSH, MYSQL, SMTP, RDP, RDPS, VNC, POP3, IMAP4, SMTPS, POP3S, FTPS, or ANY.
packetMessages	Array of `PacketMessage <listattacklogs__response_packetmessage>` objects	Attack packet information.
src_region_id	String	Source region ID.
src_region_name	String	Source region name.
dst_region_id	String	Destination region ID.
dst_region_name	String	Destination region name.
src_province_id	String	Source province ID.
src_province_name	String	Source province name.
src_city_id	String	Source city ID.
src_city_name	String	Source city name.
dst_province_id	String	Destination province ID.
dst_province_name	String	Destination province name.
dst_city_id	String	Destination city ID.
dst_city_name	String	Destination city name.

**Table 7** PacketMessage
Parameter	Type	Description
hex_index	String	Hexadecimal index.
hexs	Array of strings	Hexadecimal number sequence.
utf8_String	String	UTF-8 string.

Status code: 400

**Table 8** Response body parameters
Parameter	Type	Description
error_code	String	Error code.
error_msg	String	Error description.

Example Requests

Query 10 records on the first page of the firewall with the ID 2af58b7c-893c-4453-a984-bdd9b1bd6318 in the project 9d80d070b6d44942af73c9c3d38e0429. The query time range is 1663567058000 to 1664171765000.

https://{Endpoint}/v1/9d80d070b6d44942af73c9c3d38e0429/cfw/logs/attack?fw_instance_id=2af58b7c-893c-4453-a984-bdd9b1bd6318&start_time=1663567058000&end_time=1664171765000&limit=10

Example Responses

Status code: 200

Return value for querying attack logs.

{
  "data" : {
    "limit" : 10,
    "records" : [ {
      "action" : "deny",
      "app" : "HTTP",
      "attack_rule" : "Tool Nmap Web Server Probe Detected",
      "attack_rule_id" : "336154",
      "attack_type" : "Web Attack",
      "direction" : "out2in",
      "dst_ip" : "100.95.148.49",
      "dst_port" : 8080,
      "event_time" : 1664146216000,
      "level" : "MEDIUM",
      "log_id" : "15591",
      "packet" : "+hZUZMhV+hY/AaHMCABFKABpXPNAADAGof1kVe6QZF+UMcTQH5B0wdaz888+uoAYAOVyNQAAAQEICjrmikVb9JLCR0VUIC9uaWNlJTIwcG9ydHMlMkMvVHJpJTZFaXR5LnR4dCUyZWJhayBIVFRQLzEuMA0KDQo=",
      "packetMessages" : [ {
        "hex_index" : "00000000",
        "hexs" : [ "fa", "16", "54", "64", "c8", "55", "fa", "16", "3f", "01", "a1", "cc", "08", "00", "45", "28" ],
        "utf8_String" : ".\u0016Td.U.\u0016?.....E("
      }, {
        "hex_index" : "00000010",
        "hexs" : [ "00", "69", "5c", "f3", "40", "00", "30", "06", "a1", "fd", "64", "55", "ee", "90", "64", "5f" ],
        "utf8_String" : ".i\\.@.0...dU.d_"
      }, {
        "hex_index" : "00000020",
        "hexs" : [ "94", "31", "c4", "d0", "1f", "90", "74", "c1", "d6", "b3", "f3", "cf", "3e", "ba", "80", "18" ],
        "utf8_String" : ".1..?.t.ֳ..>..."
      }, {
        "hex_index" : "00000030",
        "hexs" : [ "00", "e5", "72", "35", "00", "00", "01", "01", "08", "0a", "3a", "e6", "8a", "45", "5b", "f4" ],
        "utf8_String" : "..r5......:.E[."
      }, {
        "hex_index" : "00000040",
        "hexs" : [ "92", "c2", "47", "45", "54", "20", "2f", "6e", "69", "63", "65", "25", "32", "30", "70", "6f" ],
        "utf8_String" : "..GET /nice%20po"
      }, {
        "hex_index" : "00000050",
        "hexs" : [ "72", "74", "73", "25", "32", "43", "2f", "54", "72", "69", "25", "36", "45", "69", "74", "79" ],
        "utf8_String" : "rts%2C/Tri%6Eity"
      }, {
        "hex_index" : "00000060",
        "hexs" : [ "2e", "74", "78", "74", "25", "32", "65", "62", "61", "6b", "20", "48", "54", "54", "50", "2f" ],
        "utf8_String" : ".txt%2ebak HTTP/"
      }, {
        "hex_index" : "00000070",
        "hexs" : [ "31", "2e", "30", "0d", "0a", "0d", "0a" ],
        "utf8_String" : "1.0\r.\r."
      } ],
      "packet_length" : 119,
      "protocol" : "TCP",
      "source" : "0",
      "src_ip" : "100.85.238.144",
      "src_port" : 50384,
      "src_province_id" : "source province id",
      "src_province_name" : "source province name",
      "src_city_id" : "source city id",
      "src_city_name" : "source city name",
      "dst_province_id" : "dst province id",
      "dst_province_name" : "dst province name",
      "dst_city_id" : "dst city id",
      "dst_city_name" : "dst city name"
    } ],
    "total" : 1
  }
}

Status code: 400

Bad Request

{
  "error_code" : "00500002",
  "error_msg" : "Invalid interval."
}

Status Codes

Status Code	Description
200	Return value for querying attack logs.
400	Bad Request
401	Unauthorized
403	Forbidden
404	Not Found
500	Internal Server Error

Error Codes

See Error Codes <errorcode>.

47 KiB Raw Permalink Blame History