1789457593a:5:{s:6:"status";b:1;s:4:"data";a:1:{i:0;a:1:{i:0;s:3:"100";}}s:11:"data_labels";a:1:{i:0;s:4:"caps";}s:6:"search";s:3622:"search index="mss-waf-cloud_1f568f8d3c2b42d387f927cf435ecd4d" sourcetype="radware:waf_cloud_security_events" earliest=-7d latest=now severity IN ("Critical","High","Medium") | spath output=app_id path=enrichmentContainer.applicationId | eval w_sev=case(severity="Critical",4,severity="High",3,severity="Medium",2,1=1,1) | eval protected=if(action="Blocked" OR action="Modified",1,0) | join type=left max=0 app_id [ search index="mss-waf-cloud_1f568f8d3c2b42d387f927cf435ecd4d" sourcetype="radware:waf_cloud_applications" | spath output=app_id path=id | spath output=main_domain path=featuresData.wafFeatureData.mainDomain.mainDomain | stats values(main_domain) as main_domain by app_id | lookup CriticalAssetDatabase.csv row.server_name AS main_domain OUTPUT row.criticality AS criticality | eval criticality=if((isnotnull(criticality) AND criticality!="null" AND criticality!=""),criticality,"High") | table app_id criticality ] | eval criticality=if(isnull(criticality) OR criticality="null" OR criticality="","High",criticality) | eval cad_factor=case(criticality="Critical",4,criticality="High",3,criticality="Medium",2,criticality="Low",1,1=1,3) | eval W=w_sev*cad_factor | stats sum(eval(W*protected)) as wp, sum(W) as wt | append [ search index="mss-waf-cloud_1f568f8d3c2b42d387f927cf435ecd4d" sourcetype="radware:waf_cloud_bot_events" earliest=-7d latest=now bot_category!="JavaScript Challenge" | eval risk_weight=case(bot_category="Malicious Intent detected",4,bot_category="Low & Slow attack",4,bot_category="Malicious browser behaviour",4,bot_category="Anomalous JavaScript sensor data",4,bot_category="Headless Chrome",3,bot_category="Automation User Agent",3,bot_category="Malicious Headers",3,bot_category="Multiple User Agents with same User Session Cookie",3,bot_category="Multiple different browsers for same User Session Cookie",3,bot_category="Conditional Rate limiting based on Bad IP Reputation",3,bot_category="Conditional Rate limiting based on Session cookie and coming without JavaScript data",3,bot_category="Standard Header Anomaly",2,bot_category="Invalid User Agents",1,bot_category="Legacy Browsers",1,bot_category="Misbehaving legitimate bots",1,1=1,2) | eval acted=if(response_code IN ("Block Access","FeedFakeData","Feed Fake Data","Challenge CAPTCHA","Crypto Challenge","Throttle","Drop","Session Termination","Redirect Loop"),1,0) | stats sum(eval(risk_weight*acted)) as sev_prot, sum(risk_weight) as sev_tot, sum(acted) as acted_ct, count as tot by app_id | join type=left max=0 app_id [ search index="mss-waf-cloud_1f568f8d3c2b42d387f927cf435ecd4d" sourcetype="radware:waf_cloud_applications" | spath output=app_id path=id | spath output=main_domain path=featuresData.wafFeatureData.mainDomain.mainDomain | stats values(main_domain) as main_domain by app_id | lookup CriticalAssetDatabase.csv row.server_name AS main_domain OUTPUT row.criticality AS criticality | eval criticality=if((isnotnull(criticality) AND criticality!="null" AND criticality!=""),criticality,"High") | table app_id criticality ] | eval criticality=if(isnull(criticality) OR criticality="null" OR criticality="","High",criticality) | eval cad_factor=case(criticality="Critical",4,criticality="High",3,criticality="Medium",2,criticality="Low",1,1=1,3) | stats sum(eval(cad_factor*sev_prot)) as wp, sum(eval(cad_factor*sev_tot)) as wt, sum(acted_ct) as acted_ct, sum(tot) as tot | eval enforce_rate=if(tot>0,round(100*acted_ct/tot,2),0) | eval wp=if(enforce_rate<1,0,wp), wt=if(enforce_rate<1,0,wt) | table wp wt ] | stats sum(wp) as wp, sum(wt) as wt | eval caps=if(wt>0,round(100*wp/wt,0),"No data") | table caps";s:16:"cache_expiration";i:86399;}