Tencent Cloud WAF¶

Tencent Cloud Web Application Firewall (WAF) is an AI-based one-stop solution for web business operational risk protection. The displayed Metrics include WAF operational status, attack count, attack traffic, attack IP count, attack domain count, attack port count, attack type distribution, attack source distribution, attack time distribution, attack trend, etc. These Metrics reflect the operational status and attack situation of WAF.

Configuration¶

Install Func¶

It is recommended to activate TrueWatch Integration - Extensions - DataFlux Func (Automata): All prerequisites are automatically installed. Please continue with the script installation.

If you want to deploy Func manually, refer to Manual Deployment of Func

Install WAF Collection Script¶

Note: Please prepare the Tencent Cloud AK that meets the requirements in advance (for simplicity, you can directly grant global read-only permission ReadOnlyAccess)

To synchronize the monitoring data of WAF, we install the corresponding collection script: "TrueWatch Integration (Tencent Cloud-WAF)" (ID: integration_tencentcloud_waf)

After clicking [Install], enter the corresponding parameters: Tencent Cloud AK, Tencent Cloud account name.

Click [Deploy Startup Script], and the system will automatically create the Startup script set and configure the corresponding startup script.

After enabling, you can see the corresponding automatic trigger configuration in "Management / Automatic Trigger Configuration". Click [Execute] to execute it immediately without waiting for the scheduled time. After a while, you can view the execution task records and corresponding logs.

Verification¶

1. In "Management / Automatic Trigger Configuration", confirm whether the corresponding task has the automatic trigger configuration, and you can also check the corresponding task records and logs for any exceptions.
2. In TrueWatch, check whether asset information exists in "Infrastructure / Custom".
3. In TrueWatch, check whether there is corresponding monitoring data in "Metrics".

Metrics¶

After configuring Tencent Cloud Cloud Monitoring, the default Measurement is as follows. You can collect more Metrics through configuration Tencent Cloud Cloud Monitoring Metrics Details

Note When pulling Web Application Firewall Metrics data, please select the "Guangzhou" region uniformly.

Overview of Parameters Corresponding to Each Dimension¶

Object¶

The collected Tencent Cloud WAF object data structure can be seen in "Infrastructure-Custom"

{
  "time": 1749782297000,
  "AppId": "1311317185",
  "CCList": "[]",
  "ClsStatus": "0",
  "Cname": "15bfb3de8de69192de22b581c2a66571.qcloudwzgj.com",
  "CreateTime": "2025-06-09T14:47:48+08:00",
  "Domain": "",
  "DomainId": "13f6c2f0def0558e9f5234270434d1b0",
  "Edition": "sparta-waf",
  "EditionNum": "0",
  "Engine": "1",
  "InstanceId": "waf_2l12weqc17ldfpop",
  "InstanceName": "gz-Default",
  "Level": "2",
  "LoadBalancerSet": "[]",
  "Ports": "[{\"NginxServerId\": 408141, \"Port\": \"80\", \"Protocol\": \"http\", \"UpstreamPort\": \"80\", \"UpstreamProtocol\": \"http\"}]",
  "Region": "gz",
  "RegionId": "",
  "RsList": "[\"134.175.221.0/24\"]",
  "SrcList": "[]",
  "State": "1",
  "Status": "1",
  "__docid": "CO_fcaf33c5dcca7aca4735e6b5d9857f2e",
  "__namespace": "custom_object",
  "__update_time": 1749782297000,
  "account_name": "",
  "class": "tencentcloud_waf",
  "cloud_provider": "tencentcloud",
  "create_time": 1749782297797,
  "date": 1749782297000,
  "date_ns": 1749782297000000000,
  "last_update_time": 1749782297797,
  "message": "{\"AccessStatus\": 1, \"AlbType\": \"\", \"ApiStatus\": 0, \"AppId\": 1311317185, \"BotStatus\": 0, \"CCList\": [], \"CdcClusters\": \"\", \"CloudType\": \"\", \"ClsStatus\": 0, \"Cname\": \"15bfb3de8de69192de22b581c2a66571.qcloudwzgj.com\", \"CreateTime\": \"2025-06-09T14:47:48+08:00\", \"Domain\": \"xxxxx.com\", \"DomainId\": \"13f6c2f0def0558e9f5234270434d1b0\", \"Edition\": \"sparta-waf\", \"EditionNum\": 0, \"Engine\": 1, \"FlowMode\": 0, \"InstanceId\": \"waf_2l12weqc17ldfpop\", \"InstanceName\": \"gz-Default\", \"Ipv6Status\": 0, \"Labels\": [\"\"], \"Level\": 2, \"LoadBalancerSet\": [], \"Mode\": 1, \"Note\": \"\", \"Ports\": [{\"NginxServerId\": 408141, \"Port\": \"80\", \"Protocol\": \"http\", \"UpstreamPort\": \"80\", \"UpstreamProtocol\": \"http\"}], \"PostCKafkaStatus\": 0, \"PostCLSStatus\": 0, \"Region\": \"gz\", \"RegionId\": \"ap-guangzhou\", \"RsList\": [\"134.175.221.0/24\"], \"SgDetail\": \"\", \"SgID\": \"\", \"SgState\": 0, \"SrcList\": [], \"State\": 1, \"Status\": 1, \"UpstreamDomainList\": [\"www.xxxxx.com\"]}",
  "name": "13f6c2f0def0558e9f5234270434d1b0",
  "time_us": 1749782297000000,
  "__searches": []
}

Note: The fields in tags, fields may change with subsequent updates