Each entry is the name to use in these pages. Where the web management console label and the API field differ, both are given.
A Mikiri WAF component that is installed, configured and reported in the event log. The agents are Filter, MLA, MLC, API, WMC and Scanner. The event log names them filter, mla, mlc and scanner.
The Filter settings that send a visitor to antibot.html and the allow lists of URLs, addresses and countries. The web management console page is Antibot. Connecting the CAPTCHA page is described in Integrating with CAPTCHA.
API (mikiri-waf-api). It stores events and settings and it is the point through which the other agents exchange them. The same name is used for the HTTP methods on that agent. Installation is in Mikiri WAF API. The method list is in API methods.
Analysis of a request against an OpenAPI specification. Specifications, API addresses and excluded addresses are managed in API Firewall settings. A request that does not match the specification receives blocking type 14.
The site or API that Filter protects. In WMC it is a virtual host under Web server → Virtual hosts, identified by server_name. The API stores that host in the nginx_settings entity. The program that receives a permitted request is reached through an upstream.
A recorded request or response that Filter, MLA, or MLC analyzed. WMC shows these records on Attacks. The API path is /attacks/v1/get_attacks. That page of the API also calls the same records events. These pages call them attacks. An agent message about its own operation is an event.
Automatic blocking of a source IP address after blocked requests. The Filter option is waf_autoban. Addresses added this way are the temporary block list. The API is List of automatically blocked IP addresses.
The server that receives a permitted request. WMC calls the named group of those servers an upstream. A location sends traffic there with proxy_pass.
A model built by MLC from the traffic of listed domains and used to mark anomalous requests. WMC edits the domain list under WAF settings → ML settings. The API entity is models. Management and tuning are in Behavioral model management and Behavioral model tuning. How detection works is in How ML detection works.
Automatic blocking of a source IP address after blocked requests. The Filter option is waf_autoban. Addresses added this way are the temporary block list. The API is List of automatically blocked IP addresses.
The list of blocked IP addresses. Backup methods use the entity name BL. In the web management console the page is Blocked IP: Permanent blocked is edited by hand, Temporary blocked is filled by autoban. A request from an address on this list receives blocking type 16.
Blocking type. The identifier assigned to a request or a response after analysis, whether or not it was blocked. The values are listed in Request processing statuses. The header x-waf-bt carries the same identifier. Attack records store it as bt.
A tariff plan. A key of this plan receives 401 and Not available for your plan on the methods limited to the Enterprise plan. The list is in Tariff restrictions.
Mikiri WAF CAPTCHA. A visitor who passes it can remove an IP address that MLC blocked as brute-force, flood or DDoS. Installation, the gCAPTCHA example and the Filter options are in Integrating with CAPTCHA.
Country code. A field of an attack record and of a request processing rule. The header described in Headers of Mikiri WAF can show the country-code rule result on the custom block page.
Cluster ID. The identifier of one cluster. The license key determines the CID. In WMC the key button in the header is the active CID. Settings saved in the web management console and through the API apply to that CID.
The agents that share one CID. Settings, the block list and behavioral models are stored for the cluster and stay inside it. Described in Clustering and fault tolerance.
The signature identifier in the Filter log. A line CRL ID 1 in PATH is signature ID 1 in the PATH zone. The test request /mikiri-waf-test is that signature.
Replacement of sensitive values before they are stored or shown. The settings are in Masking sensitive data. The web management console page is Data masking.
Processing in which the event is written and the request or response is not blocked. The Filter options use the suffix _dm, for example waf_host_dm. An attack record has dm when it was recorded this way. WMC calls this Detection mode. Detection mode for the host is waf_host_dm.
A MLC layout with one master node and any number of auxiliary nodes. The master builds the behavioral model. Activation is in Distributed operation mode. The API virtual host accepts these nodes at MLS.
The tariff plan that includes response processing rules, Scanner, request and traffic statistics and the related backup methods. A key of the Business plan receives 401 on those methods. The list is in Tariff restrictions.
Request processing rules. A rule blocks a request or excludes it from analysis. The web management console page is Rules. The API is Request processing rules.
The end user license agreement, published at EULA. It is the document that limits a license key to one installed Filter.
A message from an agent about its own operation: a license check, a network failure, a settings change, signature analysis. The level is debug, info, warn, error, or fatal. An administrator reads them in WMC under System → Logs. The API path is /ec/v1/get_events. Categories are listed in Event classification. A blocked or recorded request is an attack.
An exclusion. In WMC a rule is an Exclusion rule when it must not block and Deactivate analysis turns analysis off for a host, address, or URL. The API sets wl: true on an request processing rule or a response processing rule, or uses a Filter option whose name ends in _wl. Those options are WL.
Filter (mikiri-waf-filter). The agent that accepts a request from a visitor or an API client, analyzes the request and the response and proxies a legitimate request to the application. Installation and the Filter options that stay in waf.conf are in Filter.
A flaw reported by Scanner. WMC and the API call it a vulnerability.
The protocol used to send a request body to antivirus software. The Filter option is waf_icap_av. The setup is in Integration with antivirus software. A request blocked by antivirus software receives blocking type 4.
The unique identifier of an agent. Attack and statistics methods filter it with iid. Response examples use the placeholder %IID%.
The package description of API says that it handles events and incidents. WMC and the API methods have no incident object. A security record is an attack. A message about the agent itself is an event.
Mikiri WAF IP Geolocation API. It holds country, proxy, Tor, crawler, block-list and other IP geolocation and privacy data used in Mikiri WAF. Agents ask the API for it. The API fetches a successful answer from IPG API, caches it and returns it. Described in Introduction.
The key of one installed Filter. It selects the CID. The Filter option is waf_product_key. API requests send it as key. WMC calls it a product key. The EULA calls it a Software Key and allows it on one Filter.
MLA. The machine-learning agent on the Filter server. It analyzes requests that signature analysis did not block on its own. A request it blocks receives blocking type 3. The event log names this agent mla.
MLC (mikiri-waf-mlc). The agent that builds behavioral models and detects brute-force (blocking type 7), machine-learning attacks (blocking type 8), flood (blocking type 9) and DDoS (blocking type 10). It does not block the request. Installation and the operating modes are in MLC.
The location /mls/ block in the virtual host of API. It is the path used by MLC servers in distributed mode. The example is in Configuring the agent.
Former name of Detection mode.
A MLC layout in which one MLC server receives traffic from more than one Filter, including Filters in different clusters. The settings are in Point-to-multipoint operation mode.
WMC and the API have no object named policy. Options for a host, a URL, or an address are WAF settings → Common, stored as filter_settings. A block or an exclusion is a rule.
The license key, as named in WMC (Add product key) and in the key field of an API request.
A check, run by Scanner, of whether an event already recorded by Mikiri WAF can be reproduced. It stays enabled. It does not use scan_schedule and can run while a classic scan is running. Described in Recheck.
Response processing rules. A rule matches a response body or header, or excludes a signature in the response. Available on the Enterprise plan. The API is Response processing rules. A response blocked by a signature or by one of these rules receives blocking type 17.
A Blocking rule or an Exclusion rule on WAF settings → Rules. A request processing rule. A response processing rule. The API entities are erl and rprl. Time of action is a number of hours after which the web management console turns the rule off.
Scanner (mikiri-waf-scanner). The agent that scans the protected application for vulnerabilities and runs Recheck. Available on the Enterprise plan. Installation is in Scanner.
The number on a signature. A signature with a score of 12 is blocked by the Filter and is not sent to MLA. min_score in waf_mla_core is the score from which a request is passed to MLA. The test signature mikiri-waf-test has a score of 12.
A pattern the Filter matches in a zone of the request or the response, such as PATH, BODY or HEADERS. The log writes the match as CRL ID. A signature can be turned off for a zone by request processing rule or response processing rule.
The name in WMC for the servers that receive a permitted request: Web server → Upstreams. A location sets proxy_pass to that name. The API stores upstreams in nginx_settings. These pages use upstream for what is sometimes called a backend.
Recheck. Scanner reproduces an attack already stored. get_recheck_status is true when the vulnerability is confirmed and false when it is not. Checking a license key is a separate action, described in License verification. The CAPTCHA verification page is the challenge shown to a blocked visitor, not Recheck.
One request processing rule that blocks attempts to exploit a known vulnerability without changing the application. These pages call that practice virtual patching. The description is in Virtual patching.
Blocking of attempts to exploit a known vulnerability by a virtual patch, without changing the application. The description is in Virtual patching.
A flaw found by Scanner. WMC shows the list under Analytics → Scanner. The API method is get_vulns. The severity field is High, Medium, or Low. Confirming that a recorded attack can be reproduced is verification.
Web Application and API Protection. The name used for the Mikiri WAF platform on the home page.
Mikiri WAF. The application-level firewall described in Introduction: the agents, the cluster and the way a request is analyzed.
The suffix of Filter options that turn analysis off for a host, address or URL, for example waf_host_wl and waf_ip_wl. A request that matches such an option is not blocked and is not sent on for machine-learning analysis. The options are in Managing settings of the Filter.
WMC (mikiri-waf-wmc). The web management console for attacks, analytics, the Nginx settings of Filter and the WAF settings of the selected CID. It reads and writes those settings through API. Installation is in WMC. The header and the CID are in Common elements.