WAF Analytics

Learn how to interpret the Web Application Firewall (WAF) dashboard and key analytics metrics in the Medianova Control Panel.

The WAF Analytics dashboard provides visibility into Web Application Firewall (WAF) activity across CDN Resources. It includes threat metrics, time-series charts, geographic distributions, attack classifications, event scores, and request-level logs.

Use the dashboard to identify suspicious traffic patterns, investigate frequently targeted endpoints, and review WAF detection activity.

Access WAF Analytics

1

Open the WAF Analytics dashboard

Sign in to the Medianova Control Panel and navigate to Analytics → WAF.

2

Select the resources

Use the resource selector to view All resources or select a specific CDN Resource.

3

Select a date range

Use the date range selector to specify the period you want to analyze.

The dashboard displays WAF activity for the selected resources and time period.

Monitor WAF Metrics

The dashboard displays four summary metrics.

Metric	Description
Total Threats	Number of detected WAF threat events during the selected period.
Blocked	Number of requests blocked by WAF.
Block rate	Percentage of detected threats that were blocked.
Attacking IPs	Number of distinct client IP addresses associated with detected WAF events.

Each card displays a comparison with a previous period, including the direction and magnitude of the change. Rate-based metrics may display changes in percentage points.

Analyze Metric Trends

Select a summary card to view its corresponding time-series data in the chart below.

The chart displays separate color-coded series for CDN Resources, allowing you to compare activity across resources.

Use the chart to identify changes in WAF activity and periods with increased numbers of detected threats.

Analyze Geographic Threat Distribution

The Source countries section displays the geographic distribution of detected WAF events.

The interactive globe uses a color scale from Fewer to More events to represent event concentration. The adjacent list displays country names, event counts, and percentages.

The available controls include:

• Compact: Displays the standard geographic overview.

• Wide: Displays an expanded layout.

• Rotating: Controls the globe's rotation.

Review Attack Classifications and Scores

The dashboard provides three summary panels: Attack types, Methods, and Score.

Attack Types

The Attack types panel groups detected events by attack classification.

Each entry displays the classification name, event count, and percentage. Additional classifications may appear under Others.

Methods

The Methods panel groups detected events by HTTP request method, such as GET, HEAD, or POST.

Each entry displays the number and percentage of events associated with that method.

Score

The Score panel groups WAF events according to their assigned scores.

Category	Displayed score
High	≥ 20
Near threshold	15
Low	5–10

The panel also displays the Average event score for the selected data.

These categories represent the dashboard's score classifications. An event score alone does not establish whether a request is malicious.

Investigate Top Targets

The Top targets section identifies request targets associated with detected WAF events.

Use the search field and the Attack type and Method filters to narrow the results.

Switch between URLs and IPs to review different target views.

URLs

The URLs view displays the following information:

Column	Description
Host	Hostname associated with the request.
Request URI	URI targeted by the request.
Method	HTTP request method.
Attack type	WAF attack classification.
Requests	Number of matching requests.
Max Score	Maximum recorded event score for the target.

Use this view to identify endpoints associated with repeated WAF events.

IPs

Select IPs to switch to the IP-based target view.

Use this view to investigate IP addresses associated with detected WAF activity.

Review the Activity Log

The Activity log displays individual WAF events for the selected resources and date range.

The visible fields include:

Column	Description
Time	Date and time of the event.
Host	Hostname associated with the request.
Request	HTTP request method and URI.
HTTP	HTTP response status code.
Client IP	Client IP address, when available.
Attack type	WAF attack classification associated with the event.

Additional fields may be available through horizontal scrolling.

Filter and Navigate Events

1

Open the event filters

Select Filter in the Activity log section.

2

Refine the results

Apply the available filters to narrow the displayed events.

3

Review matching requests

Examine the request information and HTTP response status for relevant events.

4

Navigate through records

Use the page-size selector and pagination controls to review additional records.

The table displays the total number of matching events and supports paginated navigation.

An HTTP status code such as 403 indicates that a request was forbidden. The status code alone does not identify which component generated the response.

Investigate Potential False Positives

When legitimate requests appear in WAF analytics, review the available event information before modifying the WAF configuration.

1

Identify the affected request

Locate the relevant event in Activity log.

2

Review the event details

Examine the request URI, HTTP method, source IP address, response status, and attack classification.

3

Compare related activity

Use Top targets and the time-series chart to identify related events or recurring patterns.

4

Verify the request behavior

Correlate the event with application or origin logs when additional context is required.

5

Review WAF configuration

Evaluate the applicable WAF configuration before making changes.

For additional guidance, see Handle False Positives.

Related Documentation

• Web Application Firewall (WAF)

• How to Activate WAF

• Handle False Positives

• WAF Analytics API