How to identify the top attacks using GraphQL API
This guide will explain how to filter the top attack types, ranked by occurrence, as identified by the WAF.
You can use information from the httpMetrics dataset to monitor traffic patterns, detect anomalies, and analyze potential threats. This guide explains how to filter the top attack types, ranked by occurrence, as identified by the WAF.
Querying data
To query the Top 5 attacks, identified by the WAF and ranked by occurrence, proceed as follows:
- Access the GraphiQL Playground at this link:
https://api.azion.com/v4/metrics/graphql.- You must be logged in to your Azion account. Otherwise, you’ll receive an error message.
- Send a query following this format:
Where:
| Field | Description |
|---|---|
limit | Specifies the maximum number of results to return. In this case, 5 |
filter | Defines the criteria used to filter the data returned by the query |
tsRange | A subfield of filter. Specifies a time range for filtering data. It includes begin and end fields to define the start and end date and times. Format: "YYYY-MM-DDTHH:mm:ss"; example: "2024-04-11T00:00:00" |
orderBy | Specifies the order in which the results should be returned. Examples: [wafRequestsThreat_DESC], for descending order, and [wafRequestsThreat_ASC], for ascending order |
groupBy | Specifies the fields by which the query results should be grouped. In the example: [wafAttackFamily] to group by attack families detected by the WAF |
- You’ll receive a response similar to this:
Where:
| Field | Description |
|---|---|
wafAttackFamily | Category or type of attack detected by the Web Application Firewall (WAF), based on their characteristics. Example: $SQL, $RFI, $SQL, $XSS, $OTHERS |
wafRequestsThreat | Total number of requests flagged as threats by the WAF, ranked by the most frequent attack types. Example: 216747 |