When processing requests by the machine learning module, it is extremely rare for false positives to occur (blocking a legitimate request by the machine learning module). If they occur, it is necessary to export requests to adjust the application of the behavioral model.
Adjustments are made using specially designed queries. The general conventions (authorization, response codes, the *_hash methods and paginated selection) are described in the relevant section.
Request example:
curl http://api.example.com:8080/mt/v1/get_mt_attacks --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"startTime": 1730986421,
"endTime": 1730987421,
"limit": 100,
"offset": 1,
"reverseOrder": false,
"bt": [3],
"ip": ["127.0.0.1"],
"cc": ["US"],
"host": ["example.com"],
"method": ["GET"],
"request_type": ["generic"],
"agent": ["mla"],
"mz": ["query"],
"request_id": ["e19699c37b4c26f53a9fab3a24f573c8"],
"path": ["/index.php"],
"query": ["abc"],
"body": ["some_text"],
"cookie": ["id=123jmci5"],
"other_headers": ["user_ID=admin"],
"referer": ["http://example.com"],
"user-agent": ["Mozilla/5.0"],
"search": ["abc"]
}'
Optional parameters:
startTime and endTime - the start and end date in the Unix Timestamp format for which information will be requested;limit, offset and reverseOrder - the parameters of the paginated selection;bt - ID of the lock. The search is performed according to the strict correspondence of each element of the list;ip - the IP address. The search is performed according to the strict correspondence of each element of the list;cc - the country code. The search is performed according to the strict correspondence of each element of the list;host - host, domain name. The search is performed according to the strict correspondence of each element of the list;method - the method of sending an HTTP request. The search is performed according to the strict correspondence of each element of the list;request_type - event type: ws (processed WebSocket requests), grpc (processed gRPC requests), generic (other requests);agent - the agent that transmitted the data: mla or mlc. The search is performed according to the strict correspondence of each element of the list;mz - the anomaly detection zone: path, query, body, cookie, user-agent, referer, other_headers. The search is performed according to the strict correspondence of each element of the list;request_id - the unique identifier of the request. The search is performed according to the strict correspondence of each element of the list;path - search for the occurrence of a string in the path address. The search is performed based on the occurrence of each item in the list;query - search for the occurrence of a string in the query arguments. The search is performed based on the occurrence of each item in the list;body - search for the occurrence of a string in the request body. The search is performed based on the occurrence of each item in the list;cookie - search for the occurrence of a string in the Cookie header. The search is performed based on the occurrence of each item in the list;other_headers - search for the occurrence of a string in headers (except for Cookie, User-Agent and Referer). The search is performed based on the occurrence of each item in the list;referer - search for the occurrence of a string in the Referer header. The search is performed based on the occurrence of each item in the list;user-agent - search for the occurrence of a string in the User-Agent header. The search is performed based on the occurrence of each item in the list;search - searches for the occurrence of a string for each element from the list among the query zones (path, query, body, cookie, other_headers, referer, user-agent). The search is performed based on the occurrence of each item in the list.The search for values passed as a list is based on the logical
ORprinciple.
Response format:
{
"status": "success",
"totalCount": integer,
"count": integer,
"cid": string,
"attacks": [
{
"id": integer,
"timestamp": integer,
"request_id": string,
"agent": string,
"mz": array,
"bt": integer,
"ip": string,
"cc": string,
"host": string,
"method": string,
"request_type": string,
"path": string,
"query": array,
"body": array,
"cookie": array,
"other_headers": array,
"user-agent": array,
"referer": array,
"origin": object
},
...
]
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"totalCount": 100,
"count": 25,
"cid": "119835378",
"attacks": [
{
"id": 1,
"timestamp": 1730986421,
"request_id": "e19699c37b4c26f53a9fab3a24f573c8",
"agent": "mla",
"mz": ["query"],
"bt": 3,
"ip": "127.0.0.1",
"cc": "US",
"host": "example.com",
"method": "POST",
"request_type": "generic",
"path": "/index.php",
"query": ["abc"],
"body": ["some_text"],
"cookie": ["id=123jmci5"],
"other_headers": ["user_ID=admin"],
"user-agent": ["Mozilla/5.0"],
"referer": ["http://example.com"],
"origin": {"body": "eyJTaWduYXR1cmVUeXBlIjogIjAiLCAiQ29udGVudCI6ICJVM2RoWjJkbGNpQnliMk5yY3c9PSJ9"}
},
...
]
}
totalCount - the total number of records based on the search criteria;count - the number of records returned based on the limit option limit;id - the ID of an entry in the api database (the mt_attacks table);origin - the original contents of the zones where the anomaly was detected;mz - the list of zones in which the event was recorded.The method returns the MD5 hash of the attack data submitted for model correction. If the hash has not changed, a full download is not required.
Request example:
curl http://api.example.com:8080/mt/v1/get_mt_attacks_hash --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response example:
{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/mt/v1/set_mt_fp --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"host": "example.com",
"mz": "query",
"mz_data": "abc",
"request_type": "generic"
}'
Required parameters:
host - host, domain name;mz - the zone where the anomaly was detected: path, query, body, cookie, user-agent, referer or other_headers;mz_data - the contents of the zone where the anomaly was detected. Exporting with an empty field value is not allowed.Optional parameters:
request_type - event type: ws (processed WebSocket requests), grpc (processed gRPC requests), generic (other requests).Response example:
{"status": "success", "id": %ID%}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/mt/v1/del_mt_attacks --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"id": [1, 2, 3]
}'
Response example:
{"status": "success", "deleted": 1}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Required parameters:
id - the identifiers of the entries in the api database (the mt_attacks table).Request example:
curl http://api.example.com:8080/mt/v1/get_mt_fp --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"limit": 100,
"offset": 1,
"reverseOrder": false,
"id": [1],
"host": ["example.com"]
}'
Optional parameters:
limit, offset and reverseOrder - the parameters of the paginated selection;id - the request ID. The search is performed according to the strict correspondence of each element of the list;host - host, domain name. The search is performed according to the strict correspondence of each element of the list.The search for values passed as a list is based on the logical
ORprinciple.
Response format:
{
"status": "success",
"count": integer,
"totalCount": integer,
"cid": string,
"fp": [
{
"id": integer,
"timestamp": integer,
"mz": string,
"host": string,
"path": string,
"query": string,
"body": string,
"cookie": string,
"user-agent": string,
"referer": string,
"other_headers": string
},
...
]
}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"count": 1,
"totalCount": 1,
"cid": "119835378",
"fp": [
{
"id": 1,
"timestamp": 173096451,
"mz": "query",
"host": "example.com",
"path": null,
"query": "abc",
"body": null,
"cookie": null,
"user-agent": null,
"referer": null,
"other_headers": null
},
{
"id": 2,
"timestamp": 173096451,
"mz": "other_headers",
"host": "example.com",
"path": null,
"query": null,
"body": null,
"cookie": null,
"user-agent": null,
"referer": null,
"other_headers": "application/json-patch+json"
}
]
}
totalCount - the total number of records based on the search criteria;count - the number of records returned based on the limit option limit;id - the ID of the entry in the api database (the mt_fp table);mz - the zone of the exported request. The contents of the request are returned in the field corresponding to this zone (path, query, body, cookie, user-agent, referer or other_headers); the remaining zones contain null.By default, the list of records is returned in descending order from new records to old ones.
Request example:
curl http://api.example.com:8080/mt/v1/get_mt_fp_hash --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response example:
{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
The values passed as a list are applied according to the logical
ANDprinciple.
Request example:
curl http://api.example.com:8080/mt/v1/del_mt_fp --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"id": [1]
}'
Response example:
{"status": "success", "deleted": 3}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
id - ID of the entry in the api database (the mt_fp table).