Attack Logs
최신 업데이트：2025-08-15 15:55:32
Reading time: About 4 minutes
The Attack Logs page shows details of attack requests that were identified by a protection policy and had an action applied. On this page, you can view the details of every request that triggered a security policy.
Request Traffic Analysis: If you need to analyze all requests, go to Analysis & Logs > Security Analysis > Request Traffic to perform the analysis.
Path: Analysis & Logs > Attack Logs
Query Logs Using Filters
- Select a time range and a hostname
- Click the filter icon, then select a field, an operator, and a condition value. For example, to filter by client IP: select the field Client IP, select the operator Equals, and enter the IP address
- Click Query
Tip: Multiple values for the same query field are combined with OR logic; multiple different fields are combined with AND logic.
Example: If you add the conditions "Client IP equals127.0.0.1" AND "Status Code equals403;404", the query returns data where the IP is 127.0.0.1 AND the status code is 403 OR 404.
Note: Attack Logs are stored for the most recent 180 days by default, and the maximum time range for a single query is 31 days.
Log Fields
The table below lists the fields currently supported by Attack Logs:
| Field Category | Field | Description |
|---|---|---|
| General | Policy Type | The type of policy the request triggered |
| Final Security Action | The action executed by the rule or policy that the client request matched | |
| Client IP | The IP address of the client that sent the request | |
| Client IP Location | The geolocation of the client IP | |
| Path | The relative path of the request, excluding the hostname and request parameters | |
| URI | The absolute path of the request, excluding the hostname | |
| Request ID | A unique identifier for each request | |
| Event ID | A unique identifier generated for the event when a request triggers a rule | |
| User-Agent | The User-Agent field in the client request header | |
| Referer | The Referer field in the client request header | |
| Request Method | The request method of the client request | |
| HTTP Version | The HTTP version of the client request | |
| API Name | The name of the custom API | |
| Status Code | The HTTP status code returned to the client | |
| JA3 Fingerprint | A client TLS handshake fingerprinting method | |
| JA4 Fingerprint | A client TLS handshake fingerprinting method, an improved version of JA3 | |
| IP/Geo Firewall | Policy Name | The name of the sub-feature under the IP/Geo Firewall security policy |
| DDoS Protection | Policy Name | The name of the sub-feature under the DDoS Protection security policy |
| Rule ID | The ID of the matched rule | |
| Rule Name | The name of the matched rule | |
| WAF | Rule Type | The rule type of the WAF rule the client request matched |
| Rule ID | The ID of the matched rule | |
| Rule Name | The name of the matched rule | |
| Bot Management | Policy Name | The name of the sub-feature under the Bot Management security policy |
| Bot Category | The bot category of the blocked client request | |
| Bot Name | The bot name of the blocked client request | |
| Rule Name | The name of the matched rule | |
| Browser Fingerprint | The browser fingerprint assigned to the client request by the Web Risk Detection feature | |
| Custom Rules | Rule Name | The name of the matched rule |
| Rule ID | The ID of the matched rule | |
| Rate Limiting | Rule Name | The name of the matched rule |
| Rule ID | The ID of the matched rule | |
| Threat Intelligence | Intelligence Type | The type of threat intelligence the client request matched |
View Request Details
After filtering, the system shows the most recent 10,000 matching logs. Expand a log entry to see the following information:
| Information Category | Description |
|---|---|
| Policy Information | Shows the security policy and rule that the request triggered |
| General Information | Shows basic information about the request, such as the request ID, event ID, request method, and path |
| Raw Request Information | Shows the raw header information of the request |
| Client Information | Shows the client’s IP, the geolocation of that IP, and other details |