The Event Collector accumulates the events about the operation of the Mikiri WAF agents (license verification, interaction with the API, signature analysis, etc.), which allows you to diagnose the state of the agents without direct access to the servers on which they are installed.
Data is requested using specially designed queries. The general conventions (authorization, response codes, the *_hash methods and paginated selection) are described in the relevant section.
Available only for the
Enterpriseplan.The storage period of events is set by the
EC_STORAGE_PERIODoption in the configuration file of the API. With the value0, events are not saved.
Request example:
curl http://api.example.com:8080/ec/v1/get_events --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"startTime": 1730986421,
"endTime": 1730987421,
"limit": 100,
"offset": 0,
"reverseOrder": false,
"ip": ["10.10.10.1"],
"iid": ["abad7224dfef6baee9434d470d96e3c4"],
"agent": ["filter"],
"level": ["error"],
"category": ["api"]
}'
Optional parameters:
startTime and endTime - the start and end date in the Unix Timestamp format for which information will be requested;limit, offset and reverseOrder - the parameters of the paginated selection;ip - the IP address of the agent;iid - the unique identifier of the agent;agent - the type of the agent;level - the level of the event;category - the category of the event.The search for each parameter is performed according to the strict correspondence of each element of the list.
Response format:
The contents of the description field are returned in their original form (decoded from Base64). The statistics in the stats field are calculated for the period startTime-endTime without taking into account the remaining filters, as well as limit and offset.
{
"status": "success",
"count": integer,
"totalCount": integer,
"cid": string,
"events": [
{
"id": integer,
"ip": string,
"iid": string,
"agent": string,
"level": string,
"category": string,
"timestamp": integer,
"description": string
},
...
],
"stats": {
"agent": {"filter": integer},
"iid": {"74be16979710d4c4e7c6647856088456": integer},
"ip": {"127.0.0.1": integer},
"level": {"info": integer},
"category": {"analysis": integer}
}
}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"count": 1,
"totalCount": 1,
"cid": "119835378",
"events": [
{
"id": 1,
"ip": "10.10.10.1",
"iid": "abad7224dfef6baee9434d470d96e3c4",
"agent": "filter",
"level": "error",
"category": "api",
"timestamp": 1730986421,
"description": "An error occurred while sending data to the API"
}
],
"stats": {
"agent": {"filter": 1},
"iid": {"abad7224dfef6baee9434d470d96e3c4": 1},
"ip": {"10.10.10.1": 1},
"level": {"error": 1},
"category": {"api": 1}
}
}
count - the number of records returned based on the limit option limit;totalCount - the total number of records based on the search criteria;cid - the identifier of the Mikiri WAF cluster;id - the ID of an entry in the api database;stats - the number of events grouped by the corresponding parameter.Request example:
curl http://api.example.com:8080/ec/v1/del_events --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"timestamp": 1730986421,
"id": [1, 2, 3],
"ip": ["10.10.10.1"],
"iid": ["abad7224dfef6baee9434d470d96e3c4"],
"agent": ["filter"],
"level": ["error"],
"category": ["api"]
}'
Optional parameters:
timestamp - the date (inclusive) in the Unix Timestamp format up to which the events are deleted;id - the identifiers of the entries in the api database;ip - the IP addresses of the agents;iid - the unique identifiers of the agents;agent - the types of the agents;level - the levels of the events;category - the categories of the events.Different parameters are combined according to the logical
ANDprinciple the values within one parameter - according to the logicalORprinciple.If no parameter is set, all the events of the cluster will be deleted.
Response example:
{"status": "success", "deleted": 3}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
deleted - the number of deleted events.filter - Filter;mla - MLA;mlc - MLC;scanner - Scanner.debug - debugging information;info - informational message;warn - warning;error - error;fatal - critical error.Common for all agents:
auth - verification of the license key, of the tariff plan and so on;os - interaction with the operating system (memory, disk);network - network: the inability to establish a connection or to send data, timeouts, connection breaks, starting and stopping a socket or a port;api - interaction with the API;settings - settings;parsing - decoding and normalization of data;misc - events that are not included in any category (the output of information about the IID, CID, the number of signatures, etc.).Filter:
nginx - interaction with Nginx (setting mismatches, RFC violations);signature - signature analysis;mla - interaction with MLA;mlc - interaction with MLC;icap - interaction with the ICAP service;rabbitmq - interaction with RabbitMQ;autoban - the automatic blocking mechanism;geo - the IP geolocation functionality;antibot - anti-bot analysis;openapi - the operation of the API Firewall;analysis - request processing that is not included in any other group.MLA:
filter - interaction with the dynamic module;ml - the operation of the machine learning module;geo - the IP geolocation functionality;mgmt - the service management interface;antibot - anti-bot analysis;openapi - the operation of the API Firewall;analysis - request processing that is not included in any other group.MLC:
filter - interaction with the dynamic module;rabbitmq - interaction with RabbitMQ;ml - the operation of the machine learning module;geo - the IP geolocation functionality;bf - brute-force and flood analysis;ddos - DDoS analysis;openapi - the operation of the API Firewall;analysis - request processing that is not included in any other group.Scanner:
scan - the operation of the scanning module;%ModuleName% - the operation of a specific scanning module;db - interaction with the database.Stored events can be forwarded to a Syslog collector. See API settings.