Querying Top N Attack Source IP Addresses

Function Description

This API is used to query the top N attack source IP addresses.

URI

• URI format

  GET /v1/{project_id}/waf/event/attack/source?top={top}&from={from}&to={to}&hosts={hostids}

  

  An example of a URI is as follows:

  GET /v1/3ac26c59e15a4a11bb680a103a29ddb6/waf/event/attack/type?from=1543976973635&to=1563976973635&hosts=3211757cafa3437aae24d760022e79ba&hosts=93029844064b43739b51ca63036fbc4b&hosts=34fe5f5c60ef4e43a9975296765d1217

• Parameter description

  Table 1 Path parameters

  Parameter	Mandatory	Type	Description
  project_id	Yes	String	Specifies the project ID.
  top	No	Integer	Specifies the top n attack source IP addresses to be queried. The default value is 5.
  from	Yes	Long	Specifies the start time (UTC) in milliseconds. For example, 1548172800000.
  to	Yes	Long	Specifies the end time (UTC) in milliseconds. For example, 1548431999000.
  hosts	No	Array	Specifies the domain IDs.

Request

Request parameters

None

Response

Response parameters

Example

{
  "total": 4,
  "items": [
     {"ip": "X.X.1.1", "num": 1000},
     {"ip": "X.X.1.2", "num": 1000},
     {"ip": "X.X.1.3", "num": 1000},
     {"ip": "X.X.1.4", "num": 1000}
   ]
}

Status Code

For details about error status codes, see Status Codes.