Analyze Attack Events

Reading time: About 5 minutes

The Attack Events module is used to review protection effectiveness and investigate false positives. It provides a centralized view of every event that was identified and acted on by a security protection policy (DDoS Protection, WAF, etc.), including requests that were blocked or flagged. By analyzing these requests that have already been identified as threats, you can clearly evaluate the effectiveness of your existing protection policies and fine-tune them as needed.

Path: Analysis & Logs > Security Analysis > Attack Events

Protection Effectiveness Evaluation Workflow

Step 1: Select a Hostname to Analyze

In protection-effectiveness evaluation or false-positive investigation scenarios, the affected hostname you need to analyze is usually already known. After opening the page, first select the hostname you want to review. Once selected, the page displays that hostname’s attack events for the past 24 hours by default.

Step 2: Locate and Analyze

1. Narrow the Analysis Scope: Review Statistical Trends

Check Current Protection Status

The statistical trend chart displays the distribution trend of security policy types matched by this hostname by default, giving you a clear view of which policy type is currently providing the most protection. Switch to the security handling action dimension to view fluctuations in the number of requests blocked, challenged, etc., and identify time periods with abnormal activity.

By combining the policy-type and handling-action perspectives, add the suspected anomalous time period and the corresponding policy type to your filter conditions to further narrow the analysis scope.

Multi-Dimensional Attack Trends

This chart lets you select different statistical dimensions to display the trend for the top five attack events:

• Attack Request Attributes: Host, client IP, country/region, etc.
• Matched Policy Rule Details: DDoS Protection rule name, WAF rule type, etc.

2. Identify Attack Characteristics: Review Top Statistics

Top Statistics displays a ranking of the key request attributes that triggered the security policy, helping you understand who is attacking, how they’re attacking, and what they’re targeting:

3. Adjust the Analysis Scope: Use Filters

Manually adding filter conditions:

1. Select the time range you want to focus on
2. Click the filter icon, then select a field, an operator, and a condition value to customize which data you filter in or exclude
3. For example, to filter by client IP: select the field “Client IP”, select the operator “Equals”, and enter the IP address

Quickly filtering via chart legends:
Hover over a data legend in the chart to reveal Filter and Exclude buttons — click one to quickly filter based on that legend’s value.

Tip: Multiple values for the same query field are combined with OR logic; multiple different fields are combined with AND logic.
Example: Adding "Client IP equals 127.0.0.1" AND "Status Code equals 403;404" returns data where the IP is 127.0.0.1 AND the status code is 403 OR 404.

Step 3: Verify Your Analysis Results

Review Sample Logs

After pinpointing the attack characteristics, use the Sample Logs section to review the detailed field values of each attack event, further verifying the specific content to determine whether it is a genuine attack or a false positive.

Examples of criteria for identifying a false positive:

• The request path is a legitimate business URL, and the client IP is a known legitimate source → likely a false positive
• Attack events are concentrated on a specific path, and that path also carries legitimate business traffic → compare against the normal request characteristics for that path

Once you’ve confirmed a false positive, go to the corresponding policy and add an exception.