Security event notification list
WAF 3.0 generates security events for protected resources. Use CloudMonitor to monitor these events and configure alerts.
Web core protection events
WAF 3.0 generates web core protection events using a sliding statistical model. All four event types share the same trigger logic.
Trigger logic
WAF evaluates intercepted requests in a 10-minute tumbling window, updated every minute. Each minute's value is the number of requests intercepted in that minute.
An event starts when both conditions are met:
The current number of intercepted requests exceeds 600.
The current number of intercepted requests is more than three standard deviations above the average over the past 11 minutes.
An event ends when the current number of intercepted requests drops below the 11-minute average.
The following table maps each event type to its corresponding protection module.
Event name | Protection module |
Access control event V3 | |
CC attack event V3 | |
Web attack event V3 | |
Scan protection event V3 |
Access control event V3
Triggered by the Custom rules module when the event trigger conditions are met.
Event notification format:
{
"product": "WAF",
"resourceId": "acs:waf:cn-hangzhou:160***904:instanceId/<resource-id>",
"level": "CRITICAL",
"instanceName": "instanceName",
"regionId": "cn-hangzhou",
"name": "wafv3_event_aclattack",
"content": {
"start_time": "2025-08-22 09:30:00",
"product": "***",
"instance_id": "waf***b03",
"attack_type": "***",
"resource": "epa***ecs",
"end_time": "2025-08-22 09:32:00",
"action": "***",
"aliuid": "100***717"
},
"status": "acl"
}content field descriptions:
Field | Description | Example |
| The time when the event started. | 2025-08-22 09:30:00 |
| The product. Value: | *** |
| The WAF instance ID. | waf***b03 |
| The attack type. Value: | *** |
| The protected resource. | epa***ecs |
| The time when the event ended. | 2025-08-22 09:32:00 |
| Whether the event started or ended. Valid values: | *** |
| The Alibaba Cloud account ID. | 100***717 |
HTTP flood attack event V3
Triggered by the HTTP flood protection module when the event trigger conditions are met.
Event notification format:
{
"product": "WAF",
"resourceId": "acs:waf:cn-hangzhou:128***596:instanceId/<resource-id>",
"level": "CRITICAL",
"instanceName": "instanceName",
"regionId": "cn-hangzhou",
"name": "wafv3_event_ccattack",
"content": {
"start_time": "2025-08-22 09:38:00",
"product": "***",
"instance_id": "waf***301",
"attack_type": "***",
"resource": "qrc***waf",
"end_time": "2025-08-22 09:50:00",
"action": "***",
"aliuid": "114***469"
},
"status": "cc"
}content field descriptions:
Field | Description | Example |
| The time when the event started. | 2025-08-22 09:38:00 |
| The product. Value: | *** |
| The WAF instance ID. | waf***301 |
| The attack type. Value: | *** |
| The protected resource. | qrc***waf |
| The time when the event ended. | 2025-08-22 09:50:00 |
| Whether the event started or ended. Valid values: | *** |
| The Alibaba Cloud account ID. | 114***469 |
Web attack event V3
Triggered by the Web core protection rules module when the event trigger conditions are met.
Event notification format:
{
"product": "WAF",
"resourceId": "acs:waf:ap-southeast-1:128***596:instanceId/<resource-id>",
"level": "CRITICAL",
"instanceName": "instanceName",
"regionId": "cn-hangzhou",
"name": "wafv3_event_webattack",
"content": {
"start_time": "2025-08-22 09:53:00",
"product": "***",
"instance_id": "waf***e03",
"attack_type": "***",
"resource": "alb***alb",
"end_time": "2025-08-22 09:56:00",
"action": "***",
"aliuid": "107***523"
},
"status": "web"
}content field descriptions:
Field | Description | Example |
| The time when the event started. | 2025-08-22 09:53:00 |
| The product. Value: | *** |
| The WAF instance ID. | waf***e03 |
| The attack type. Value: | *** |
| The protected resource. | alb***alb |
| The time when the event ended. | 2025-08-22 09:56:00 |
| Whether the event started or ended. Valid values: | *** |
| The Alibaba Cloud account ID. | 107***523 |
Scan protection event V3
Triggered by the Scan protection module when the event trigger conditions are met.
Event notification format:
{
"product": "WAF",
"resourceId": "acs:waf:cn-hangzhou:128***596:instanceId/<resource-id>",
"level": "CRITICAL",
"instanceName": "instanceName",
"regionId": "cn-hangzhou",
"name": "wafv3_event_webscan",
"content": {
"start_time": "2025-08-22 09:55:00",
"product": "***",
"instance_id": "waf***t08",
"attack_type": "we***an",
"resource": "www***waf",
"end_time": "2025-08-22 09:57:00",
"action": "***",
"aliuid": "160***699"
},
"status": "webscan"
}content field descriptions:
Field | Description | Example |
| The time when the event started. | 2025-08-22 09:55:00 |
| The product. Value: | *** |
| The WAF instance ID. | waf***t08 |
| The attack type. Value: | we***an |
| The protected resource. | www***waf |
| The time when the event ended. | 2025-08-22 09:57:00 |
| Whether the event started or ended. Valid values: | *** |
| The Alibaba Cloud account ID. | 160***699 |
API security event V3
Triggered when the Threat Detection module detects an important threat, or when an important event occurs in the Security Events module of API Security.
Event notification format:
{
"product": "WAF",
"resourceId": "acs:waf:cn-hangzhou:160***904:instanceId/<resource-id>",
"level": "CRITICAL",
"instanceName": "instanceName",
"regionId": "cn-hangzhou",
"name": "wafv3_event_apisec",
"content": {
"api_id": "b85***491",
"risk_id": "9e3***6f1",
"risk_type": "Internal***logon(We*** Pas***sed Lo*** *** In***al ",
"api_format": "/in***hp/ad***/Lo***/ch***in",
"discover_time": "2025-08-22 09:31:54",
"matched_host": "pop***com"
},
"status": "overrun"
}content field descriptions:
Field | Description | Example |
| The API asset ID. | b85***491 |
| The threat ID. | 9e3***6f1 |
| The type of threat or security event. | Internal***logon(We*** Pas***sed Lo*** *** In***al |
| The API format. | /in***hp/ad***/Lo***/ch***in |
| The time when the threat or event was first discovered. | 2025-08-22 09:31:54 |
| The domain name or IP address. | pop***com |
Billing protection trigger event V3
The traffic billing protection feature sets a default queries per second (QPS) threshold for pay-as-you-go instances. If the peak QPS within an hour exceeds this threshold, the WAF instance enters a sandbox and this event is triggered. For more information, see Traffic billing protection.
Event notification format:
{
"product": "WAF",
"resourceId": "acs:waf:ap-southeast-1:128***596:instanceId/<resource-id>",
"level": "CRITICAL",
"instanceName": "instanceName",
"regionId": "cn-hangzhou",
"name": "xray_wafv3_event_cost_protection",
"content": {
"instance": "waf***h36",
"qps": "12***",
"startTime": "2025-08-22 10:00:00.0",
"endTime": "2025-08-22 10:00:00.0",
"spec": "10***",
"status": "Sa***ox"
},
"status": "overrun"
}content field descriptions:
Field | Description | Example |
| The WAF instance ID. | waf***h36 |
| The peak QPS. | 12*** |
| The time when the event started. | 2025-08-22 10:00:00.0 |
| The time when the event ended. | 2025-08-22 10:00:00.0 |
| The QPS specification. | 10*** |
| The instance status. | Sa***ox |
Log capacity overuse event V3
If you enable Simple Log Service for WAF on a subscription instance and the log storage usage exceeds 80%, this event is triggered.
Upgrade your storage capacity promptly to avoid log loss.
Event notification format:
{
"product": "WAF",
"resourceId": "-",
"level": "CRITICAL",
"regionId": "cn-hangzhou",
"instanceName": "-",
"name": "xray_wafv3_event_log_exceed",
"content": {
"storageUsed": "2.5T",
"storageQuota": "3.0T",
"logstoreName": "***",
"projectName": "wafng-***-hangzhou",
"region": "cn-hangzhou",
"percent": "84.6",
"ds": 1756346411092
},
"status": "overrun"
}content field descriptions:
Field | Description | Example |
| The used log storage. | 2.5T |
| The total log storage capacity. | 3.0T |
| The Logstore name. Value: | *** |
| The project name. | wafng-***-hangzhou |
| The region. | cn-hangzhou |
| The storage usage percentage. | 84.6 |
| The UNIX timestamp. | 1756346411092 |
QPS overuse event V3
This event is triggered when the actual peak QPS of a subscription instance exceeds its purchased QPS specification, or when the peak QPS of a pay-as-you-go instance exceeds the specified threshold. In either case, the instance may enter a sandbox. For more information, see Sandbox description.
Event notification format:
{
"product": "WAF",
"resourceId": "acs:waf:ap-southeast-1:128***596:instanceId/<resource-id>",
"level": "CRITICAL",
"instanceName": "instanceName",
"regionId": "cn-hangzhou",
"name": "xray_wafv3_event_qps_exceed",
"content": {
"times": "8",
"instance": "waf***a08",
"qps": "***",
"cause": "Enters sandbox due to accumulated***",
"startTime": "2025-08-22 10:10:00.0",
"endTime": "2025-08-22 10:14:00.0",
"spec": "***",
"status": "***"
},
"status": "overrun"
}content field descriptions:
Field | Description | Example |
| The number of overuse instances. | 8 |
| The WAF instance ID. | waf***a08 |
| The peak QPS. | *** |
| The reason the event was triggered. | Enters sandbox due to accumulated*** |
| The time when the event started. | 2025-08-22 10:10:00.0 |
| The time when the event ended. | 2025-08-22 10:14:00.0 |
| The QPS specification. | *** |
| The instance status. | *** |
WAF v3 pre-migration expiration alert
When migrating from WAF 2.0 to WAF 3.0, a 15-day upgrade window is provided. This alert fires at 5, 3, and 1 days remaining in the window. If you do not confirm the upgrade before the window expires, the instance and its configurations are rolled back to WAF 2.0, and the WAF 3.0 instance is released.
Confirm the upgrade in the WAF console before the window expires to avoid rollback. For more information, see How to upgrade a WAF 2.0 instance to WAF 3.0.
Event notification format:
{
"product": "WAF",
"resourceId": "acs:waf:ap-southeast-1:128***596:instanceId/<resource-id>",
"level": "CRITICAL",
"regionId": "cn-hangzhou",
"instanceName": "instanceName",
"name": "xray_wafv3_evnet_migrate_lost_days",
"content": {
"remainDays": 3
},
"status": "overrun"
}content field descriptions:
Field | Description | Example |
| The number of days remaining in the migration window. | 3 |