Document toolboxDocument toolbox

waf.fastly

Introduction

The tags beginning with waf.fastly identify events generated by Fastly.

Valid tags and data tables 

The full tag must have 4 levels. The first two are fixed as waf.fastly. The third level identifies the type of events sent. The fourth level indicates the event subtype.

These are the valid tags and corresponding data tables that will receive the parsers' data:

Product / Service

Tags

Data tables

Product / Service

Tags

Data tables

Fastly Next-Gen WAF

waf.fastly.nextgen_waf.site_activity.corp.site

waf.fastly.nextgen_waf

waf.fastly.nextgen_waf.corp_activity

waf.fastly.nextgen_waf.corp_event

waf.fastly.nextgen_waf.request_feed

waf.fastly.nextgen_waf.site_activity

For more information, read more About Devo tags.

Table structure

These are the fields displayed in these tables:

waf.fastly.nextgen_waf

Field

Type

Source field name

Extra fields

Field

Type

Source field name

Extra fields

eventdate

timestamp

 

 

hostname

str

 

 

type

str

vsubtype

 

id

str

 

 

event_type

str

 

 

timestamp

timestamp

 

 

message

str

 

 

created

timestamp

 

 

remote_country_code

str

 

 

remote_hostname

str

 

 

at_devo_environment

str

 

 

at_devo_pulling_id

str

 

 

hostchain

str

 

 ✓

tag

str

 

 ✓

rawMessage

str

 

 ✓

waf.fastly.nextgen_waf.corp_activity

Field

Type

Extra fields

Field

Type

Extra fields

eventdate

timestamp

 

hostname

str

 

id

str

 

event_type

str

 

msg_data__corp_name

str

 

msg_data__detail_link

str

 

msg_data__email

str

 

msg_data__token_name

str

 

msg_data__user_agent

str

 

msg_data__inviter_email

str

 

msg_data__inviter_name

str

 

msg_data__recipient_email

str

 

msg_data__role

str

 

msg_data__site_roles

str

 

msg_data__site_word

str

 

message

str

 

attachments

str

 

created

timestamp

 

at_devo_environment

str

 

at_devo_pulling_id

str

 

corp_name

str

 

site

str

 

rawMessage

str

 ✓

hostchain

str

 ✓

tag

str

 ✓

waf.fastly.nextgen_waf.corp_event

Field

Type

Field transformation

Source field name

Extra fields

Field

Type

Field transformation

Source field name

Extra fields

eventdate

timestamp

 

 

 

hostname

str

 

 

 

id

str

 

 

 

timestamp

timestamp

 

 

 

source_ip4

ip4

ip4(source)

source

 

source_ip6

ip6

ip6(source)

source

 

remote_country_code

str

 

 

 

remote_hostname

str

 

 

 

user_agents

str

 

 

 

action

str

 

 

 

threat_type

str

 

 

 

reasons_sqli

int4

 

 

 

reasons_xss

int4

 

 

 

reasons_cmdexe

int4

 

 

 

reasons_traversal

int4

 

 

 

request_count

int4

 

 

 

tag_count

int4

 

 

 

window

int4

 

 

 

expires

timestamp

 

 

 

expired_by

str

 

 

 

at_devo_environment

str

 

 

 

at_devo_pulling_id

str

 

 

 

detected_timestamp

timestamp

 

 

 

alert_id

str

 

 

 

example_request__id

str

 

 

 

example_request__server_hostname

str

 

 

 

example_request__remote_ip4

ip4

ip4(example_request__remote_ip)

example_request__remote_ip

 

example_request__remote_ip6

ip6

example_request__remote_ip

 

example_request__remote_hostname

str

 

 

 

example_request__remote_country_code

str

 

 

 

example_request__user_agent

str

 

 

 

example_request__timestamp

timestamp

 

 

 

example_request__method

str

 

 

 

example_request__server_name

str

 

 

 

example_request__protocol

str

 

 

 

example_request__tls_protocol

str

 

 

 

example_request__tls_cipher

str

 

 

 

example_request__path

str

 

 

 

example_request__uri

str

 

 

 

example_request__scheme

str

 

 

 

example_request__headers_in

str

 

 

 

example_request__agent_response_code

int4

 

 

 

example_request__response_code

int4

 

 

 

example_request__response_size

int4

 

 

 

example_request__response_millis

int4

 

 

 

example_request__headers_out

str

 

 

 

example_request__summation__attacks

str

 

 

 

example_request__tags

str

 

 

 

corp_name

str

 

 

 

site

str

 

 

 

rawMessage

str

 

 

✓

hostchain

str

 

 

✓

tag

str

 

 

✓

waf.fastly.nextgen_waf.request_feed

Field

Type

Field transformation

Source field name

Extra fields

Field

Type

Field transformation

Source field name

Extra fields

eventdate

timestamp

 

 

 

hostname

str

 

 

 

id

str

 

 

 

server_hostname

str

 

 

 

remote_ip4

ip4

remote_ip

 

remote_ip6

ip6

remote_ip

 

remote_hostname

str

 

 

 

remote_country_code

str

 

 

 

user_agent

str

 

 

 

timestamp

timestamp

 

 

 

method

str

 

 

 

server_name

str

 

 

 

protocol

str

 

 

 

file_path

str

 

 

 

uri

str

 

 

 

response_code

int4

 

 

 

response_size

int4

 

 

 

response_millis

int4

 

 

 

agent_response_code

int4

 

 

 

tags

str

 

 

 

detected_timestamp

timestamp

 

 

 

source_ip4

ip4

source

 

source_ip6

ip6

source

 

user_agents

str

 

 

 

action

str

 

 

 

threat_type

str

 

 

 

reasons_sqli

int4

 

 

 

reasons_cmdexe

int4

 

 

 

reasons_traversal

int4

 

 

 

reasons_useragent

int4

 

 

 

reasons_xss

int4

 

 

 

request_count

int4

 

 

 

tag_count

int4

 

 

 

window

int4

 

 

 

expires

timestamp

 

 

 

expired_by

str

 

 

 

alert_id

str

 

 

 

example_request__id

str

 

 

 

example_request__server_hostname

str

 

 

 

example_request__remote_ip4

ip4

example_request__remote_ip

 

example_request__remote_ip6

ip6

example_request__remote_ip

 

example_request__remote_hostname

str

 

 

 

example_request__remote_country_code

str

 

 

 

example_request__user_agent

str

 

 

 

example_request__timestamp

timestamp

 

 

 

example_request__method

str

 

 

 

example_request__server_name

str

 

 

 

example_request__protocol

str

 

 

 

example_request__tls_protocol

str

 

 

 

example_request__tls_cipher

str

 

 

 

example_request__path

str

 

 

 

example_request__uri

str

 

 

 

example_request__scheme

str

 

 

 

example_request__headers_in

str

 

 

 

example_request__agent_response_code

int4

 

 

 

example_request__response_code

int4

 

 

 

example_request__response_size

int4

 

 

 

example_request__response_millis

int4

 

 

 

example_request__headers_out

str

 

 

 

example_request__summation__attacks

str

 

 

 

example_request__tags

str

 

 

 

at_devo_environment

str

 

 

 

at_devo_pulling_id

str

 

 

 

corp_name

str

 

 

 

site

str

 

 

 

rawMessage

str

 

 

✓

hostchain

str

 

 

✓

tag

str

 

 

✓

waf.fastly.nextgen_waf.site_activity

Field

Type

Field transformation

Source field name

Extra fields

Field

Type

Field transformation

Source field name

Extra fields

eventdate

timestamp

 

 

 

hostname

str

 

 

 

id

str

 

 

 

event_type

str

 

 

 

msg_data__ip4

ip4

msg_data__ip

 

msg_data__ip6

ip6

msg_data__ip

 

msg_data__affected_tags

str

 

 

 

msg_data__agent_action

str

 

 

 

msg_data__alert_action

str

 

 

 

msg_data__analyze_duration

str

 

 

 

msg_data__attacks

str

 

 

 

msg_data__corp

str

 

 

 

msg_data__country_name

str

 

 

 

msg_data__detail_link

str

 

 

 

msg_data__duration

str

 

 

 

msg_data__event_date

timestamp

msg_data__event_date_str

 

msg_data__event_host

str

 

 

 

msg_data__formatted_tags

str

 

 

 

msg_data__id

str

 

 

 

msg_data__malicious_requests

str

 

 

 

msg_data__overlap_check

str

 

 

 

msg_data__rule_detail

str

 

 

 

msg_data__site

str

 

 

 

message

str

 

 

 

created

timestamp

 

 

 

at_devo_environment

str

 

 

 

at_devo_pulling_id

str

 

 

 

attachments

str

 

 

 

corp_name

str

 

 

 

site

str

 

 

 

rawMessage

str

 

 

✓

hostchain

str

 

 

✓

tag

str

 

 

✓