This graph shows Hits, Blocked, Passed, and Bots
The Countries view shows all the metrics
The dropdown list is for administering user tags, described further below.
An example List page
An example Editor page, for Global Filters
The Dashboard page, with the "Top Metrics" section at bottom set to Countries.
Filtering the chart to show only Hits and Blocked requests, by disabling Passed and Bots.
The user has expanded the "Additional details" section.
The user right-clicked on "Blocked by origin".
A Global Filter, opened in its Editor
A Flow Control Policy, opened within its Editor page
Click to expand this image.
Click to expand this image.
The name or IP address for each endpoint that L11WAAP protects. (Do not enter self-referential values such as 127.0.0.0/8, 0.0.0.0, ::1/128, ::0/128 or “localhost”.)
The host can be a normal web server, or it can be a load-balancer. Note that L11WAAP also provides load-balancing capabilities in its own right, as discussed below.
In Port Bridge Mode, it is possible to specify more than one host, separated by commas (as in the screenshot above).
| Phase | Description |
|---|---|
| Request Pre Processing | Executes immediately when L11WAAP receives an incoming request, before any other processing occurs.
|
| Request Post Processing | Executes after L11WAAP has finished processing the request, and before it sends the request to the backend server.
|
| Response Pre Processing | Executes when L11WAAP receives the response from the backend.
|
| Response Post Processing | Executes as the last action before L11WAAP sends the response to the client.
|
There are four Access Levels within L11WAAP:
click to enlarge
{
"AND": [
{
"field": "timestamp",
"op": "between",
"value": [
"2024-06-06 09:31:00",
"2024-06-06 09:36:00"
]
},
{
"field": "status",
"op": "eq",
"value": 301
}
]
}
| Field name | Comments | Description |
|---|---|---|
| acl_triggers | Populated during evaluation of the active ACL Profile. Contains keys: action (the type of Action that was triggered) extra (currently unused) tags trigger_id trigger_name | |
| arguments | Arguments of the request, if any. Query string and JSON examples for mysite.com/page?foo=1 : arguments["foo"]="1" {"field": "arguments", "key": "^foo$", "op": "eq", "value": "1"} | |
| asn | string | |
| authority | string | |
| biometric | array | |
| blocked | boolean | |
| bot | boolean | |
| branch | string | |
| bytes_sent | integer | |
| challenge | boolean | |
| challenge_type | string | |
| cf_restrict_triggers | array | |
| cf_triggers | Populated if the request triggered a Content Filter Rule. Contains keys: action, extra, name, risk_level, ruleid, section, trigger_id, trigger_name, value. All have string values, except for risk_level, which is an integer. | |
| challenge | boolean | |
| challenge_type | string | |
| cookies | Can inspect specific cookies or all cookies. See JSON filter examples. | |
| country | string | |
| dr_triggers | array | |
| geo_region | string | |
| gf_triggers | An array of entries, one for each Global Filter that matched the request. Each entry contains these keys: action, extra, name, section, trigger_id, trigger_name, value | |
| headers | Can inspect specific headers or all headers. See JSON filter examples. | |
| host | string | |
| hostname | string | |
| human | boolean | |
| ichallenge | boolean | |
| ip | string | |
| logs | array | |
| messages | An array of strings, containing messages added to the event by the system. These can include messages injected into events by Edge Functions. | |
| method | string | |
| monitor | boolean: whether or not the request triggered a Monitor action. | |
| monitor_reasons | array of strings; the various reasons (if any) that the request triggered Monitor actions. | |
| organization | string | |
| path | string. The path excluding the TLD and excluding arguments; the string begins with "/". | |
| path_parts | string. Contents for mysite.com/abc/123/home.html?foo=true: "part1": "abc", "part2": "123", "part3": "home.html", "path": "/abc/123/home.html" } | |
| port | string | |
| processing_stage | integer: the furthest stage of traffic filtering that was reached. 0: Initialization 2: Global Filtering 3. Flow Control 4. Global Rate Limits 5. Rate Limits 6. ACL Profile 7. Content Filtering | |
| profiling | array of items containing the security settings relevant to this request. Each item contains: a name (secpol, mapping, flow, limit, acl, content_filter) and value (the internal ID of that setting). | |
| protocol | string | |
| proxy | array of items containing proxy-related data. Each item contains a name and value. The names are: additional_tags, bytes_sent, container, geo_as_domain, geo_as_name, geo_as_type, geo_company_country, geo_company_domain, geo_company_type, geo_lat, geo_long, geo_mobile_carrier, geo_mobile_country, geo_mobile_mcc, geo_mobile_mnc, realip, request_id, request_length, request_time, ssl_cipher, ssl_protocol, status. | |
| query | string. Example: for mysite.com/page?code=117, this is ?code=117. | |
| rbz_latency | integer | |
| rbzsessionid | Cookie set by L11WAAP. Example query string and JSON: cookies["rbzsessionid"]="57870178706cb50db6d41aab" {"field": "cookies", "key": "^rbzsessionid$", "op": "eq", "value": "578701713f70dcd8706cb50db6d41aab"} | |
| reason | string. The reason, if any, the request was blocked. | |
| referer | string | |
| request_id | string | |
| request_length | integer | |
| request_time | float | |
| result | string; the disposition of the request. A way to quickly see anomalies is to search for {"field": "result", "op": "not eq", "value": "Passed"} | |
| rl_triggers | array; the reasons (if any) that rate limits were triggered. | |
| security_config | The configuration of security settings when this request was processed. Keys and data types are: cf_active (boolean) cf_rules (integer) gf_rules (integer) revision (string) rl_rules (integer) secpolentryid (string) secpolid (string) | |
| session | string | |
| session_ids | array | |
| status | integer | |
| tags | array of strings: all the tags attached to the request | |
| time_period | integer; the Epoch Unix timestamp of the request | |
| timestamp | string; date and time | |
| trigger_counters | The number of times an Action was triggered, and the source of the triggers (ACL Profile, Content Filtering, Global Filters, or Rate Limits). This is a collection of keys (counters) and values (integers with the value of each counter). Counter names are strings: acl, cf, cf_restrict, dr, gf, rl. Sample filter condition: {"field": "trigger_counters", "key": "acl", "value": 0, "op": "gt"} | |
| upstream_addr | array of strings | |
| upstream_data | array of elements: {addr (string), response_time (float), status (integer)} | |
| upstream_response_time | float or null | |
| upstream_status | array of integers | |
| url | string | |
| user_agent | string | |
| version | string | |
| waap_id | Cookie set by L11WAAP. Example query string and JSON: cookies["waap_id"]="Jc491eLWqTBOfDnJwNk" {"field": "cookies", "key": "^waap_id$", "op": "eq", "value": "Jc491eLWqTBOfDnJwNk"} |
{
"NOT": {
"field": "$FIELD_NAME",
"op": "$OPERATOR",
"key": "$KEY",
"value": $VALUE
}
}
| Result field name | Type | Comments |
|---|---|---|
| avg_origin_time | float | The average amount of processing time by the origin for these requests. If no requests reached the origin, this will be null. |
| avg_rbz_time | float | The average amount of processing time by L11WAAP for these requests. |
| avg_total_time | float | The average total amount of processing time for these requests. |
| first_asn | string | First entry in the list of ASNs |
| first_geo_country | string | First entry in the list of countries |
| first_organization | string | First entry in the list of organizations |
| key | string | Content varies; see discussion below. |
| label | string | Category of result. See discussion below. |
| max_origin_time | float | The longest amount of processing time by the origin among these requests. If no requests reached the origin, this will be null. |
| max_rbz_time | float | The longest amount of processing time by L11WAAP among these requests. |
| max_total_time | float | The longest amount of total processing time among these requests. |
| min_origin_time | float | The shortest amount of processing time by the origin among these requests. If no requests reached the origin, this will be null. |
| min_rbz_time | float | The shortest amount of processing time by L11WAAP among these requests. |
| min_total_time | float | The shortest amount of total processing time among these requests. |
| num_of_blocked_requests | integer | |
| num_of_bot_requests | integer | |
| num_of_challenges | integer | |
| num_of_human_requests | integer | |
| num_of_monitored_requests | integer | Includes all requests that triggered a "monitor" action, even if they were blocked as well. |
| num_of_requests | integer | |
| sum_of_bytes_sent | integer | |
| sum_of_request_length | integer |
| API namespace | Comments |
|---|---|
| Backend Services | For managing the services L11WAAP is protecting. More info |
| Certificates | For managing SSL certificates. More info |
| Edge Functions | For running custom Lua code. More info |
| Load Balancers | For managing SSL associated with load balancers. More info |
| Mobile Application Groups | For configuring Mobile SDK parameters. More info |
| Proxy Templates | For managing architectural parameters. More info |
| Server Groups | For managing site-level properties. More info |
| API namespace | Comments |
|---|---|
| Configs | For managing configurations, the fundamental internal data structure |
| Data queries | For API access to traffic data and managing quarantined traffic sources |
| Log Exporters | For streaming events to an external destination such as a SIEM solution |
| Planets | For planet-level settings such as interactive challenges |
| Tags | For retrieval of tag data |
| Tools | For miscellaneous capabilities, including publishing |
| Users | For management of users and API keys |
| Action | Operation |
|---|---|
| To retrieve information about all load balancers | GET .../load-balancers |
| To add a certificate | PUT .../{entry_name}/certificates/{certificate_id} |
| To remove a certificate | DELETE .../{entry_name}/certificates |
| To get the list of Link11 WAAP datacenters, and each city's current preference | GET .../regions |
| To set preferred datacenters for each city | POST .../regions |