> For the complete documentation index, see [llms.txt](https://clients.medianova.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clients.medianova.com/api-documentation/analytics/waf-analytics.md).

# WAF Analytics

Retrieve Web Application Firewall (WAF) analytics for protected CDN resources, including security events, attack trends, rule matches, and client activity.

Use the WAF Analytics API to retrieve security events, analyze attack activity, examine rule matches, and review client request statistics for WAF-protected CDN resources.

### Common Request Parameters

WAF Analytics endpoints use the following parameters to filter requests. Parameter availability and requirements vary by endpoint.

| Parameter           | Description                                                           | Type                           |
| ------------------- | --------------------------------------------------------------------- | ------------------------------ |
| `organization_uuid` | Unique identifier of the organization in the Medianova Control Panel. | String (UUID)                  |
| `from`              | Start timestamp of the query range.                                   | String (`YYYY-MM-DD HH:mm:ss`) |
| `to`                | End timestamp of the query range.                                     | String (`YYYY-MM-DD HH:mm:ss`) |
| `resources`         | List of CDN resource UUIDs to include in the query.                   | Array of strings               |
| `limit`             | Maximum number of records to return.                                  | Integer                        |
| `interval`          | Time aggregation interval for attack histogram data.                  | String                         |
| `waf_mode`          | WAF operating mode filter. Accepted values: `on`, `detectiononly`.    | String                         |

The `interval` and `waf_mode` parameters are available for the Attack Histogram endpoint. The other endpoints use `limit` instead.

#### Aggregation Intervals

The Attack Histogram endpoint supports the following aggregation intervals:

| Interval | Duration  |
| -------- | --------- |
| `5m`     | 5 minutes |
| `1h`     | 1 hour    |
| `2h`     | 2 hours   |
| `8h`     | 8 hours   |
| `1d`     | 1 day     |

The `interval` parameter is optional. The API specification does not define how an aggregation interval is selected when this parameter is omitted.

### Security Events

Retrieve WAF activity logs for selected CDN resources, including matched rules, actions, and request metadata.

{% openapi src="/files/218dDM2kVyaJibbEFwRm" path="/api/v1/waf\_report/activity\_logs" method="post" %}
[waf-activity-logs.json](https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2Fgit-blob-15e83ca1840d4b9356c4148a0427010e5ea1e250%2Fwaf-activity-logs.json?alt=media)
{% endopenapi %}

### Client and Request Analytics

Retrieve statistics for client IP addresses, requested URIs, and user agents associated with WAF events.

{% openapi src="/files/DvRdtZxRBXGUXi13tI5d" path="/api/v1/waf\_report/client\_ips" method="post" %}
[waf-client-ips.json](https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2Fgit-blob-d57b2d7c65af2a0c13917db193ed8176c3cfdb06%2Fwaf-client-ips.json?alt=media)
{% endopenapi %}

{% openapi src="/files/hFVoZz8iX76As1RQb6Ka" path="/api/v1/waf\_report/request\_uris" method="post" %}
[waf-request-uris.json](https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2Fgit-blob-e60fcba463798ee95cef03b8fa7d8f994a7473d9%2Fwaf-request-uris.json?alt=media)
{% endopenapi %}

{% openapi src="/files/IIlX8NrvAOxFej7u5PJc" path="/api/v1/waf\_report/user\_agents" method="post" %}
[waf-user-agents.json](https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2Fgit-blob-8f152f2be283fb1503555befb9acfe5d18c9c441%2Fwaf-user-agents.json?alt=media)
{% endopenapi %}

### Attack and Threat Analytics

Retrieve WAF event counts grouped by time interval and aggregated threat totals for selected CDN resources.

{% openapi src="/files/JAZfbvwDcHB6Rmb76QF7" path="/api/v1/waf\_report/attack\_histogram" method="post" %}
[waf-attack-histogram.json](https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2Fgit-blob-2bea3308d6f7d34cc0338b9646ffc2ccf4cc2800%2Fwaf-attack-histogram.json?alt=media)
{% endopenapi %}

{% openapi src="/files/EJL6LPzCSufBVnJjOVmH" path="/api/v1/waf\_report/total\_threats" method="post" %}
[waf-total-threats.json](https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2Fgit-blob-8219b6dd7fcf5444b145f07428da70311f40be2f%2Fwaf-total-threats.json?alt=media)
{% endopenapi %}

### WAF Rule Analytics

Retrieve rule-level statistics, including matched WAF rules, associated actions, and match counts.

{% openapi src="/files/FGSwlFzooUmcNLiD33Cy" path="/api/v1/waf\_report/rule\_details" method="post" %}
[waf-rule-details.json](https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2Fgit-blob-7e9065d5b927b2ceb501deb0772e72e357e7ef14%2Fwaf-rule-details.json?alt=media)
{% endopenapi %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://clients.medianova.com/api-documentation/analytics/waf-analytics.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.