WMC is the Web Management Interface. The API is the same data for a script. Both stay inside the CID of the key.
| Task | WMC | API |
|---|---|---|
| Attacks | Attacks, the page that opens at / |
Attacks and anomalies |
| Summary, traffic, resources | Analytics: Summary, Traffic statistics, Resource monitor | Request and traffic statistics |
| Scanner findings | Scanner results, Analytics → Scanner | Detected vulnerabilities |
| Agent status | Analytics → Resource monitor | Agent monitoring |
| Event log | System → Logs, for an administrator | Event log |
| Policies and rules | WAF settings | Filter settings, request processing rule, response processing rule |
| Certificates and hosts | Web server → SSL, Virtual hosts | Nginx settings |
| Users | System → Users. A non-administrator account is createuser |
— |
| Backups | System → Backups | Backup of agent settings |
The sections of the WMC are listed in WMC.
The record shows the host, the path, the signature the blocking type. Signature ID 1 in PATH is the test request /mikiri-waf-test. Blocking type 3 is MLA. Types 7, 8, 9 10 are MLC. Type 17 is a blocked response. The full list is Request processing statuses.
A legitimate block is handled in False positive handling. A model block is handled in How ML detection works.
Sensitive values in the stored attack record are replaced before they are written. The original cannot be read back from that record. Zones and the pattern syntax are in Masking sensitive data. Masking does not apply to the request sample returned by behavioral-model tuning. Private keys in a downloaded Nginx backup are masked separately, as described for the nginx_settings entity in Backup of agent settings.