ewalker-waf-audit-logs

Get audit logs from eWalker WAF devices.

ewalker-waf-audit-logs [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [order=ORDER]

profile=PROFILE: eWalker WAF connect profile code
duration=NUM{mon|w|d|h|m|s}: Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss: Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss: End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
order=ORDER: Scan direction. desc or asc.

Output Fields

Field	Type	Name	Description
_time	Date	Time	Log time
profile	String	Connect profile	eWalker WAF connect profile code
device_ip	IP address	Device IP	WAF device ip address
es_index	String	Index	Elastic index name
es_id	String	Log ID	Elastic log id
server_type	String	Server type	e.g. wafweb, wafserver, wafproxy, yts, yts2
user	String	User	e.g. system
action	String	Action	e.g. insert, closed, attempts, issue
action_desc	String	Action description
result	String	Subject	e.g. custom_rule, access token, login
msg	String	Message	e.g. ewafadmin custom_rule insert Success
changes	String	Changes	e.g. ID [ewafadmin] 중복 로그인
subject	String	subject	subject