0

id

string containing integer

ID of the deny log entry

1

time

string containing integer

Timestamp of the denied request

2

source

string containing integer

The source IP address represented as an integer

3

host

string containing hostname/IP address

The target host of the denied request

4

path

string containing URL path

The target path of the denied request

5

violation_id

string containing integer

ID of the violation that occurred

6

status

string containing integer

Indicates whether the deny entry has been added to the ACL

0 → has not been added to ACL
1 → has been added to ACL

7

attack_class_id

string containing integer

ID of the attack class

1 → SQL injection
2 → XPath injection
3 → SSI injection
4 → OS commanding
5 → XSS
6 → Path traversal
7 → Enumeration
8 → Format string
9 → Buffer overflow
10 → DoS attempt
11 → Worm probe
12 → Access violation
13 → Malformed request
14 → HTML tags
15 → Session invalid
16 → XSRF
17 → Session expired
18 → Detection evasion
19 → File inclusion
20 → CRLF injection
21 → HTTP request smuggling
22 → XQuery injection
23 → LDAP injection
24 → XML injection
25 → Null byte injection
35 → Information leak
50 → Backend error
51 → Broken robot
52 → Broken int. link
53 → Broken ext. link
54 → Other
60 → None
70 → False positive
99 → Friendly

8

resp_status

string containing integer

HTTP status code returned by the response

9

resp_time

string containing integer

The time from when the WSM received the request and forwarded it to the backend server until the response is sent to the client from WSM

Measured in milliseconds

10

backend_host

string containing integer

Indicates which backend host received the request (0 for 1st host, 1 for 2nd, etc)

11

action

string containing integer

Action applied to the request

-1 → Block IP
0 → Block
1 → Strip
2 → Allow

12

risk

string containing integer

Indicates risk level associated with the deny entry

1 → Critical
2 → High
3 → Medium
4 → Low
5 → None

13

ccode

string containing country code

Country code for origin of the denied request

14

proto

string containing integer

Protocol of the request

1 → http
2 → https

15

normality_score

string containing integer

Expresses the normality in parts per million

16

normality_flag

string containing integer

Indicates the normality of the denied request

0 → Normal
less than 0 → Abnormal 

17

compromise_score

string containing integer

Expresses the fidelity of the compromise observation