In order to tailor some rules in the WAF, I’ve been asked to generate a spreadsheet that has the hits against the said rules, along with the associated metadata, so it can be reviewed and adjusted as needs be. My plan as been to automate this as a NodeJS script (my preferred method for handling & manipulating JSON data) and run it weekly from Jenkins.
I’m going through the documentation from Oracle for using their NPM libraries and cannot seem to work out where the log analytics works and if I can input a query I’ve created in the dashboard as a starting point.
Their examples are here
The query looks something like this:
'Log Source' = 'OCI WAF Logs' and 'Request Protection Rule IDs' != null and 'Request Protection Rules Matched Data' != null and 'Host Name (Server)' in (my.endpoint.com) | rename URI as Requests, 'OCI Resource OCID' as 'WAF OCID', 'OCI Resource Name' as 'Enforcement Point' | search 'WAF OCID' = 'nothing to see here' | timestats count by 'WAF OCID'
My plan is to get the information and sanitise it so I can place it into a CSV file without the bloat.