WAAS analytics provide users a way to investigate events and rule triggers.
For container WAAS events go to Monitor > Events > WAAS for containers
For host WAAS events go to Monitor > Events > WAAS for hosts
For App-Embedded WAAS events go to Monitor > Events > WAAS for App-Embedded
For serverless WAAS events go to Monitor > Events > WAAS for Serverless
|WAAS retains up to 200,000 events for each type (container, hosts, app-embedded and serverless). Once the limit is reached, oldest events will get over-written by new ones.|
|Similar audits are aggregated and grouped into a single event when received in close succession (less than 5 minutes apart). Audits are aggregated by a combination of IP, HTTP hostname, path, HTTP method, User-Agent and attack type.|
WAAS analytics allows for the review of incidents by analyzing events across various dimensions, inspecting individual requests, and applying filtering to focus on common characteristics or trends.
A timeline graph shows the total number of events.
Each column on the timeline graph represents a dynamic period - hover over a column to reveal its start, end and event count.
Date filter can be used to adjust the timeline scope.
Filter can be adjusted by using the filtering line:
The filter line uses auto-complete for filter names and filter values.
Once set, the filters would apply on the graph and aggregation view.