Attack Query
Attack Queries are exchanges between Advanced Bot Protection and WAF or a FortiADC/FortiWeb device, providing data on user activity within the protected application.
- Blocked AttackQuery: The number of times ABP suggested FortiADC/ FortiWeb/ WAF to block the action detailed in the AttackQuery.
-
Blocked Bot AttackQuery: The number of times ABP suggested FortiADC/ FortiWeb/ WAF to block the action detailed in the AttackQuery, due to detected malicious bot behavior.
History graph
Hover over History Graph to view the value(s) corresponding to the area on the bar or line chart.
Attack Query Table
| Table field | Description |
|---|---|
| Timestamp | The timestamp indicating when the Attack Query was triggered. |
| Account Name | The username collected by the Attack Query, representing the account name entered by the user in the browser during actions such as login, registration, or payment on the customer's website. |
| Risk Score | A numerical score (0–100) calculated by Advanced Bot Protection to indicate the likelihood that a user is a bot. For details on the calculation factors, refer to Advanced Bot Protection. |
| IP | The IP address associated with the user activity that triggered the attack query. |
| URL | The URL on your website where the user activity that triggered the Attack Query took place. |
| Transaction ID | Unique system-generated identifier. |
Clicking on an attack query in the table expands the following details:
|
Value |
Description |
|---|---|
|
OS |
The client Operating System (OS) associated with the user activity that triggered the attack query. |
|
Country |
Country of Client IP associated with the user activity that triggered the attack query. |
|
Browser |
The browser associated with the user activity that triggered the attack query. |
|
ASN |
ASN (Autonomous System Numbers) of Client IP |
|
Suggestion |
Suggested action by FortiAppSec Cloud Advanced Bot Protection: Block or Allow. |
|
CauseBy |
Reason for the suggested action. |
|
UserAgent |
User Aagent in the HTTP request of the user activity that triggered the attack query. |
|
Method |
The HTTP request method, such as GET, POST, or PUT, used in the user activity that triggered the attack query. |
|
Label |
Request labels, such as signin, payment, or signup, associated with the user activity that triggered the attack query. |