Using API calls, you can download, delete and aggregate information about the events recorded by the Mikiri WAF agents.
Data is requested using specially designed queries. The general conventions (authorization, response codes, the *_hash methods and paginated selection) are described in the relevant section.
Request example:
curl http://api.example.com:8080/attacks/v1/get_attacks --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"startTime": 1730986421,
"endTime": 1730987421,
"limit": 100,
"offset": 0,
"reverseOrder": false,
"bodyLimit": 1024,
"iid": ["abad7224dfef6baee9434d470d96e3c4"],
"bt": [1],
"ip": ["10.10.10.1"],
"cc": ["US"],
"schema": ["http"],
"host": ["example.com"],
"port": [80],
"method": ["get"],
"rule_id": [1],
"description": ["sqli"],
"long_description": ["SQL injection"],
"mz": ["query"],
"request_id": ["e19699c37b4c26f53a9fab3a24f573c8"],
"request_type": ["generic"],
"group_id": ["7b4c26f53a9fab3a"],
"blocked": true,
"possible": false,
"path": ["/index.php"],
"query": ["abc"],
"body": ["some_text"],
"cookie": ["id=123jmci5"],
"user-agent": ["Mozilla/5.0"],
"referer": ["http://example.com"],
"other_headers": ["user_ID=admin"],
"response_body": ["some_text"],
"response_headers": ["content-type"],
"bodySizeMin": 2.5,
"responseBodySizeMin": 2.5,
"search": ["abc"]
}'
Optional parameters:
startTime and endTime - the start and end date in the Unix Timestamp format for which information will be requested;limit, offset and reverseOrder - the parameters of the paginated selection;bodyLimit - the maximum size (in characters) of the displayed contents of the body and response_body zones. Content that exceeds the limit is not displayed;iid - the unique identifier of the agent that recorded the event. The search is performed according to the strict correspondence of each element of the list;bt - the blocking type. The search is performed according to the strict correspondence of each element of the list;ip - the IP address of the request source. The search is performed according to the strict correspondence of each element of the list;cc - the country code. The search is performed according to the strict correspondence of each element of the list;schema - the request schema (for example, http). The search is performed according to the strict correspondence of each element of the list;host - host, domain name. The search is performed according to the strict correspondence of each element of the list;port - the port. The search is performed according to the strict correspondence of each element of the list;method - the method of sending an HTTP request. The search is performed according to the strict correspondence of each element of the list;rule_id - the identifier of the signature or of the request/response processing rule. The search is performed according to the strict correspondence of each element of the list;description - the attack type (for example, sqli). The value is also compared with the description of the corresponding bt (see Get the event type specification). The attack types of signature analysis are listed in Attack types. The search is performed according to the strict correspondence of each element of the list;long_description - the extended description of the event. The search is performed according to the strict correspondence of each element of the list;mz - the anomaly detection zone: path, query, body, cookie, user-agent, referer, other_headers. The search is performed according to the strict correspondence of each element of the list;request_id - the unique identifier of the request. The search is performed according to the strict correspondence of each element of the list;request_type - the event type: ws (processed WebSocket requests), grpc (processed gRPC requests), generic (other requests). The search is performed according to the strict correspondence of each element of the list;group_id - the identifier of the group of requests. The search is performed according to the strict correspondence of each element of the list;blocked - with the value true, only blocked events are displayed, with the value false - only the events detected in detection mode;possible - the sign of a possible attack (the type of the attack has not been reliably established). null searches for records where the field is empty;path, query, body, cookie, user-agent, referer, other_headers, response_body, response_headers - search for the occurrence of a string in the contents of the corresponding zone. The search is performed based on the occurrence of each item in the list;bodySizeMin - the minimum size of the request body zone content in megabytes. The entry will be found if the request body content exceeds the specified value. It is allowed to use this together with the responseBodySizeMin option. In this case, the entry will be found if the minimum size of the request body or the response body is exceeded.responseBodySizeMin - the minimum size of the response body zone content in megabytes. The record will be found if the response body content exceeds the specified value. It is allowed to use this option together with bodySizeMin. In this case, the record will be found if the minimum size of the request body or response body is exceeded.search - searches for the occurrence of a string for each element from the list among all the request and response zones.Different parameters are combined according to the logical
ANDprinciple the values within one parameter - according to the logicalORprinciple. The values are case-insensitive.For the parameters that allow an empty value,
nullin the list matches SQL NULL. An empty string matches a blank value and does not match NULL. The valuenullis not allowed forid,timestamp,dm,ip,host,methodandbt.
Response format:
{
"status": "success",
"count": integer,
"totalCount": integer,
"cid": string,
"attacks": [
{
"id": integer,
"iid": string,
"timestamp": integer,
"request_id": string,
"request_type": string,
"group_id": string,
"rule_id": integer,
"description": string,
"long_description": string,
"blocked": boolean,
"possible": boolean,
"dm": boolean,
"mz": string,
"bt": integer,
"ip": string,
"cc": string,
"schema": string,
"host": string,
"port": integer,
"method": string,
"path": string,
"query": string,
"body": string,
"cookie": string,
"user-agent": string,
"referer": string,
"other_headers": string,
"response_body": string,
"response_headers": string
},
...
]
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"count": 1,
"totalCount": 1,
"cid": "119835378",
"attacks": [
{
"id": 1,
"iid": "abad7224dfef6baee9434d470d96e3c4",
"timestamp": 1730986421,
"request_id": "e19699c37b4c26f53a9fab3a24f573c8",
"request_type": "generic",
"group_id": "7b4c26f53a9fab3a",
"rule_id": 1,
"description": "sqli",
"long_description": "SQL injection",
"blocked": true,
"possible": false,
"dm": false,
"mz": "query",
"bt": 1,
"ip": "10.10.10.1",
"cc": "us",
"schema": "http",
"host": "example.com",
"port": 80,
"method": "get",
"path": "/index.php",
"query": "id=1' or 1=1--",
"body": null,
"cookie": null,
"user-agent": "Mozilla/5.0",
"referer": null,
"other_headers": null,
"response_body": null,
"response_headers": null
}
]
}
count - the number of records returned based on the limit option limit;totalCount - the total number of records based on the search criteria;cid - the identifier of the Mikiri WAF cluster;id - the ID of an entry in the api database;dm - the event was recorded in detection mode.The method returns the number of events for the period, grouped by the main parameters.
Request example:
curl http://api.example.com:8080/attacks/v1/get_attacks_stats --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"startTime": 1730986421,
"endTime": 1730987421
}'
Required parameters:
startTime and endTime - the start and end date in the Unix Timestamp format for which information will be requested.Response format:
Grouping is performed by the parameters iid, bt, ip, cc, schema, host and port.
{
"status": "success",
"summary": {
"iid": [
{"iid": string, "count": integer}
],
"bt": [
{"bt": integer, "count": integer}
],
"ip": [
{"ip": string, "count": integer}
],
"cc": [
{"cc": string, "count": integer}
],
"schema": [
{"schema": string, "count": integer}
],
"host": [
{"host": string, "count": integer}
],
"port": [
{"port": string, "count": integer}
]
}
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
count - the number of events for the period.The method returns the statistics and the list of events (without the contents of the request zones) for each host.
Request example:
curl http://api.example.com:8080/attacks/v1/get_attacks_host_stats --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"startTime": 1730986421,
"endTime": 1730987421,
"iid": ["abad7224dfef6baee9434d470d96e3c4"],
"bt": [1],
"ip": ["10.10.10.1"],
"cc": ["US"],
"schema": ["http"],
"host": ["example.com"],
"port": [80],
"description": ["sqli"]
}'
Optional parameters:
startTime and endTime - the start and end date in the Unix Timestamp format for which information will be requested. If startTime is not set, the data is processed starting from the first event; if endTime is not set - up to the last event;iid - the unique identifier of the agent;bt - the blocking type;ip - the IP address of the request source;cc - the country code;schema - the request schema;host - virtual host, domain name. If the parameter is not set, all the hosts found by the remaining filters are processed;port - the port;description - the attack type.The search for each parameter is performed according to the strict correspondence of each element of the list.
Response format:
{
"status": "success",
"host": {
"example.com": {
"summary": {
"total": integer,
"blocked": integer,
"detected": integer
},
"iid": {"abad7224dfef6baee9434d470d96e3c4": integer},
"schema": {"http": integer},
"port": {"80": integer},
"bt": {"1": integer},
"ip": {"10.0.0.1": integer},
"cc": {"ru": integer},
"description": {"sqli": integer},
"attacks": [
{
"id": integer,
"iid": string,
"timestamp": integer,
"request_id": string,
"rule_id": integer,
"description": string,
"request_type": string,
"blocked": boolean,
"possible": boolean,
"dm": boolean,
"mz": string,
"bt": integer,
"ip": string,
"cc": string,
"schema": string,
"host": string,
"port": integer,
"method": string
},
...
]
}
}
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
total - the total number of attacks;blocked - the number of blocked attacks;detected - the number of attacks detected in detection mode;iid, schema, port, bt, ip, cc, description - the number of attacks grouped by the corresponding parameter.The method returns the correspondence between the analyzer, the bt values and the recorded event descriptions.
Request example:
curl http://api.example.com:8080/attacks/v1/get_attacks_spec --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response example:
{
"status": "success",
"specification": {
"analyzer": {
"Signature analysis": {
"bt": [1, 2],
"description": ["sqli", "xss"]
}
}
}
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
The bt values correspond to the analyzers as follows:
bt |
Analyzer |
|---|---|
0 |
Request logger |
1, 2 |
Signature analysis |
3 |
MLA |
4 |
Antivirus analysis |
5 |
Internal error |
6 |
Autoban |
7 |
Brute-force |
8 |
MLC |
9 |
Flood |
10 |
DDoS |
14 |
API Firewall |
15 |
RFC violation |
16 |
Blocked IP |
17 |
Response analysis |
How each status is assigned when a request is processed is described in Request processing statuses.
Events can be deleted by record identifier, by all set to true, or by any combination of bt, ip, host, port and older. At least one criterion is required: a request that contains only the product key does not delete anything. all set to true deletes every event of the CID and counts as that criterion.
Request example:
curl http://api.example.com:8080/attacks/v1/del_attacks --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"bt": [0, 1, 2, 3],
"ip": ["1.1.1.1", "2.2.2.2"],
"host": ["example.com", "example.us"],
"port": [80, 443],
"older": 2
}'
Deleting chosen records by identifier is also supported:
curl http://api.example.com:8080/attacks/v1/del_attacks --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"id": [1, 2, 3]
}'
Optional parameters:
id - the identifiers of the entries in the api database. Required when no other criterion is set;all - true deletes every event of the CID. Combined with other parameters, those parameters still apply;bt - the blocking type. The search is performed according to the strict correspondence of each element of the list;ip - the IP address of the request source. The search is performed according to the strict correspondence of each element of the list;host - host, domain name. The search is performed according to the strict correspondence of each element of the list;port - the port. The search is performed according to the strict correspondence of each element of the list;older - a positive integer, the age in days. Events whose timestamp is older than this number of days are deleted.Different parameters are combined according to the logical
ANDprinciple the values within one parameter - according to the logicalORprinciple. The values ofipandhostare case-insensitive.If no criterion is set, the request is rejected and no events are deleted.
Response example:
{"status": "success", "deleted": 3}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
deleted - the number of deleted events.