> For the complete documentation index, see [llms.txt](https://clients.medianova.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clients.medianova.com/products/security/web-application-firewall-waf/waf-analytics.md).

# WAF Analytics

Learn how to interpret the Web Application Firewall (WAF) dashboard and key analytics metrics in the Medianova Control Panel.

The **WAF Analytics** dashboard provides visibility into Web Application Firewall (WAF) activity across CDN Resources. It includes threat metrics, time-series charts, geographic distributions, attack classifications, event scores, and request-level logs.

Use the dashboard to identify suspicious traffic patterns, investigate frequently targeted endpoints, and review WAF detection activity.

## Access WAF Analytics

{% stepper %}
{% step %}

### Open the WAF Analytics dashboard

Sign in to the [Medianova Control Panel](https://cloud.medianova.com) and navigate to **Analytics → WAF**.
{% endstep %}

{% step %}

### Select the resources

Use the resource selector to view **All resources** or select a specific CDN Resource.
{% endstep %}

{% step %}

### Select a date range

Use the date range selector to specify the period you want to analyze.
{% endstep %}
{% endstepper %}

The dashboard displays WAF activity for the selected resources and time period.

<figure><img src="https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2FF9me191m0lK9LH4zoUnO%2Fimage.png?alt=media&amp;token=d735f265-737d-4aca-878f-a538cd352875" alt=""><figcaption></figcaption></figure>

## Monitor WAF Metrics

The dashboard displays four summary metrics.

<table><thead><tr><th width="202.800048828125">Metric</th><th>Description</th></tr></thead><tbody><tr><td><strong>Total Threats</strong></td><td>Number of detected WAF threat events during the selected period.</td></tr><tr><td><strong>Blocked</strong></td><td>Number of requests blocked by WAF.</td></tr><tr><td><strong>Block rate</strong></td><td>Percentage of detected threats that were blocked.</td></tr><tr><td><strong>Attacking IPs</strong></td><td>Number of distinct client IP addresses associated with detected WAF events.</td></tr></tbody></table>

Each card displays a comparison with a previous period, including the direction and magnitude of the change. Rate-based metrics may display changes in percentage points.

### Analyze Metric Trends

Select a summary card to view its corresponding time-series data in the chart below.

The chart displays separate color-coded series for CDN Resources, allowing you to compare activity across resources.

<figure><img src="https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2FkNtqzrr0m8vXLxcChAe2%2Fimage.png?alt=media&amp;token=38282738-ec55-473d-a956-529713fa1ad0" alt="" width="563"><figcaption></figcaption></figure>

Use the chart to identify changes in WAF activity and periods with increased numbers of detected threats.

## Analyze Geographic Threat Distribution

The **Source countries** section displays the geographic distribution of detected WAF events.

<figure><img src="https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2FBQSltvWmdJLqYHJGXNUL%2Fimage.png?alt=media&amp;token=c73897f5-aa6a-4edf-9d4f-5d1e24a7238e" alt="" width="563"><figcaption></figcaption></figure>

The interactive globe uses a color scale from **Fewer** to **More events** to represent event concentration. The adjacent list displays country names, event counts, and percentages.

The available controls include:

* **Compact:** Displays the standard geographic overview.
* **Wide:** Displays an expanded layout.
* **Rotating:** Controls the globe's rotation.

## Review Attack Classifications and Scores

The dashboard provides three summary panels: **Attack types**, **Methods**, and **Score**.

### Attack Types

The **Attack types** panel groups detected events by attack classification.

Each entry displays the classification name, event count, and percentage. Additional classifications may appear under **Others**.

### Methods

The **Methods** panel groups detected events by HTTP request method, such as `GET`, `HEAD`, or `POST`.

Each entry displays the number and percentage of events associated with that method.

### Score

The **Score** panel groups WAF events according to their assigned scores.

<table><thead><tr><th width="198">Category</th><th>Displayed score</th></tr></thead><tbody><tr><td><strong>High</strong></td><td>≥ 20</td></tr><tr><td><strong>Near threshold</strong></td><td>15</td></tr><tr><td><strong>Low</strong></td><td>5–10</td></tr></tbody></table>

The panel also displays the **Average event score** for the selected data.

These categories represent the dashboard's score classifications. An event score alone does not establish whether a request is malicious.

## Investigate Top Targets

The **Top targets** section identifies IP addresses and request URLs associated with WAF activity during the selected time period.

The section opens in the **IPs** view by default. Switch to **URLs** to investigate frequently targeted request paths.

### IPs

The **IPs** view displays client IP addresses associated with WAF events and provides risk information to support IP blocking decisions.

The table includes:

| Column           | Description                                                                           |
| ---------------- | ------------------------------------------------------------------------------------- |
| **Client IP**    | IP address associated with the requests.                                              |
| **Country**      | Country associated with the client IP address.                                        |
| **ISP**          | Internet service provider associated with the IP address.                             |
| **Attack type**  | WAF attack classification associated with the IP.                                     |
| **Requests**     | Number of requests associated with the IP during the selected period.                 |
| **Risk score**   | Percentage of requests from the IP that returned HTTP 403 during the selected period. |
| **Block status** | Indicates whether the IP is currently blocked.                                        |

The **Risk score** is calculated from the proportion of HTTP 403 responses among all requests from the IP address during the selected time period.

{% hint style="info" %}
**Risk score:** This is the attack rate from this IP address during the selected time period.

A high risk score indicates a high proportion of HTTP 403 responses. It does not independently confirm that the IP address is malicious.
{% endhint %}

**Risk Levels**

Risk scores are grouped into three levels:

| Risk level    | Risk score                        |
| ------------- | --------------------------------- |
| **No risk**   | 0%                                |
| **Low risk**  | Greater than 0% and less than 30% |
| **High risk** | 30% or higher                     |

The risk score bar uses different colors to distinguish these levels.

**Filter IP Addresses**

Use the available filters to narrow the IP list:

* **Search:** Search by host, IP address, country code, or ISP.
* **Attack type:** Filter by WAF attack classification.
* **Country:** Filter by country.
* **ISP:** Filter by internet service provider.
* **Block status:** Filter by **Blocked** or **Not blocked**.
* **Risk level:** Filter by **No risk**, **Low risk**, or **High risk**.

Select **Clear all** to remove the applied filters.

### Review IP Details

Select an IP address to open its details sidebar.

The sidebar provides additional information about the selected IP, including its risk score and available blocking controls.

**Related Hosts**

The **Related hosts** section displays hostnames associated with the selected IP address.

Each entry includes the hostname and its corresponding risk score.

Select **Show this IP on related hosts** to filter the Top targets table to the selected IP and its related hosts.

The Related hosts section is displayed only when related host information is available.

## Block an IP Address

Use the IP details sidebar to block an IP address when investigation indicates that blocking is appropriate.

{% stepper %}
{% step %}

### Select an IP address

Open **Top targets → IPs** and locate the IP address.
{% endstep %}

{% step %}

### Review the risk information

Select the IP address and review its risk score, attack classification, and related hosts.
{% endstep %}

{% step %}

### Block the IP address

Use the **Block** control in the IP details sidebar.
{% endstep %}

{% step %}

### Confirm the action

Review and confirm the blocking action when prompted.
{% endstep %}
{% endstepper %}

The IP's block status is reflected in the Top targets view.

### Unblock an IP Address

To remove an existing IP block, open the blocked IP address in the details sidebar and use the **Unblock** control.

Confirm the action when prompted.

### URLs

The **URLs** view displays request paths associated with WAF events.

Use the search field and the available **Attack type** and **Method** filters to investigate targeted endpoints.

| Column          | Description                                  |
| --------------- | -------------------------------------------- |
| **Host**        | Hostname associated with the request.        |
| **Request URI** | URI targeted by the request.                 |
| **Method**      | HTTP request method.                         |
| **Attack type** | WAF attack classification.                   |
| **Requests**    | Number of matching requests.                 |
| **Max Score**   | Maximum recorded event score for the target. |

{% hint style="info" %}
IP blocking controls are available only in the **IPs** view. They are not available for individual URLs.
{% endhint %}

## Review the Activity Log

The **Activity log** displays individual WAF events for the selected resources and date range.

The table includes request timestamps, hostnames, HTTP methods, request URIs, response status codes, client IP addresses, and attack classifications.

### Filter and Navigate Events

1. Select **Filter** to refine the displayed events.
2. Review the matching requests in the table.
3. Use the page-size selector to adjust the number of displayed records.
4. Use the pagination controls to navigate through additional records.

{% hint style="info" %}
The default page size is **5** records. Available page sizes are **5, 50, 100, 150, and 200**.
{% endhint %}

The table displays the total number of matching events.

## Investigate Potential False Positives

When legitimate requests appear in WAF analytics, review the available event information before modifying the WAF configuration.

{% stepper %}
{% step %}

### Identify the affected request

Locate the relevant event in **Activity log**.
{% endstep %}

{% step %}

### Review the event details

Examine the request URI, HTTP method, source IP address, response status, and attack classification.
{% endstep %}

{% step %}

### Compare related activity

Use **Top targets** and the time-series chart to identify related events or recurring patterns.
{% endstep %}

{% step %}

### Verify the request behavior

Correlate the event with application or origin logs when additional context is required.
{% endstep %}

{% step %}

### Review WAF configuration

Evaluate the applicable WAF configuration before making changes.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
For additional guidance, see [Handle False Positives](https://clients.medianova.com/products/security/web-application-firewall-waf/handle-false-positives).
{% endhint %}

### Related Documentation

* [Web Application Firewall (WAF)](https://clients.medianova.com/products/security/web-application-firewall-waf)
* [How to Activate WAF](https://clients.medianova.com/products/security/web-application-firewall-waf/how-to-activate-waf)
* [Handle False Positives](https://clients.medianova.com/products/security/web-application-firewall-waf/handle-false-positives)
* [WAF Analytics API](https://clients.medianova.com/api-documentation/analytics/waf-analytics)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://clients.medianova.com/products/security/web-application-firewall-waf/waf-analytics.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.