Monitoring with system-generated dashboards

1. Log in to the Fastly control panel.
2. Go to Security > Next-Gen WAF > Dashboards.
3. From the workspaces bar, click the menu to the right of the workspace name and select a workspace.
4. From the dashboards menu , select the dashboard you want to switch to. The selected dashboard appears.

To interact with the dashboard data:

• use the time selector menu to adjust the time range that's reported on. Additionally, use the granularity menu to adjust how the data is displayed in the cards.

  

• at the bottom of a card, click Quick look to expand the card and view requests matching the card parameters. Alternatively, click View requests to view requests matching the card parameters on the Requests page.

1. Click the name of your workspace (site) in the upper left corner of the control panel.
2. From the dashboards menu , select the dashboard you want to switch to. You can narrow down the list by using the search field. The selected dashboard appears.

To interact with the dashboard data:

• use the time selector menu to adjust the time range that's reported on. Additionally, use the granularity menu to adjust how the data is displayed in the cards.

  

• at the bottom of a card, click the button to access additional information related to the metric.

Viewing a dashboard in monitor view

Clicking the monitor at the top of the dashboard displays your dashboard in focus mode. Focus mode displays the Site Overview page as you’ve customized it and temporarily hides the rest of the control panel. While in focus mode, you can create a read-only URL so that you can view your dashboard on a TV.

To set up monitor view on a TV:

1. On the Site Overview page, select the relevant dashboard from the Dashboard menu.
2. Click the monitor . The Site Overview page appears in focus mode in the default grid view.
3. Click Share.
4. Click the Read-only URL switch.
5. Copy the link and open it on the TV you’d like to display the dashboard on.

You can change the focus mode view from the default grid view to carousel view by clicking Carousel. In the carousel view, the monitor will cycle through all cards on the Site Overview page. If necessary, you can generate a new URL, which invalidates the old URL. You can also disable the read-only URL altogether.

The Overview dashboard includes the following cards:

• Request volume: a graph displaying the number of requests the workspace received over time.
• OWASP injection attacks: a graph displaying the most common OWASP Top 10 attacks the workspace received over time.
• Scanners: a graph displaying the number of commercial and open source scanning tools over time.
• Traffic source anomalies: a graph displaying the number of requests from unusual or suspicious sources over time.
• Request anomalies: a graph displaying the number of anomalous behaviors within request headers over time.
• Response anomalies: a graph displaying the number of client and server error codes over time.
• Events: a list of IP addresses that were flagged for exceeding thresholds.
• Top Attacks: a list of the top URLs containing attack signals.

The Overview dashboard includes the following cards:

• Request volume: a graph displaying the number of requests the site received over time.
• OWASP Injection Attacks: a graph displaying the most common OWASP Top 10 attacks the site received over time.
• What's new: a list of the latest Next-Gen WAF feature announcements.
• Scanners: a graph displaying the number of commercial and open source scanning tools over time.
• Traffic Source Anomalies: a graph displaying the number of requests from unusual or suspicious sources over time.
• Events: a list of IPs that were flagged for exceeding thresholds. Click View all events to open the Events page.
• Request Anomalies: a graph displaying the number of anomalous behaviors within request headers over time.
• Response Anomalies: a graph displaying the number of client and server error codes over time.
• Suspicious IPs: a list of IPs that are approaching thresholds. Once the threshold is met or exceeded, the IP address will be flagged and added to the Events list. If the agent mode is set to blocking, then all malicious requests from flagged IPs are blocked (without blocking legitimate traffic).
• Authentication: a graph displaying the number of attempts to log in to application endpoints over time.
• Top Attacks: a list of the top URLs containing attack signals.

The Bot Management dashboard includes the following cards:

• Verified bot activity: a graph displaying verified bots represented on a per-category basis.
• Bot activity: a graph displaying the number of requests made by suspected bots, suspected bad bots, and verified bots over time.
• Client challenges: a graph representing requests that were issued a Browser Challenge or verified by the Verify Token rule action and labeled as either providing a valid or an invalid challenge token.
• Headless bot activity: a graph displaying the traffic from bots detected as being headless browsers leveraging automation tooling such as selenium, puppeteer, and playwright.
• AI bot activity: a graph displaying traffic from bots detected as being an AI crawler or AI fetcher.
• Compromised credentials: a graph displaying requests from clients either registering or logging in with a known compromised password.
• Traffic source anomalies: a graph displaying the number of requests from unusual or suspicious sources over time.

The Bot Management dashboard includes the following cards:

• Verified Bot Activity: a graph displaying verified bots represented on a per-category basis.
• Bot Activity: a graph displaying the number of requests made by suspected bots, suspected bad bots, and verified bots over time.
• Client Challenges: a graph representing requests that were issued a Browser Challenge or verified by the Verify Token rule action and labeled as either providing a valid or an invalid challenge token.
• Authentication: a graph displaying the number of attempts to log in to application endpoints over time.
• Traffic Source Anomalies: a graph displaying the number of requests from unusual or suspicious sources over time.
• Headless Bot Activity: a graph displaying the traffic from bots detected as being headless browsers leveraging automation tooling such as selenium, puppeteer, and playwright.
• AI Bot Activity: a graph displaying traffic from bots detected as being an AI crawler or AI fetcher.
• Compromised Credentials: a graph displaying requests from clients either registering or logging in with a known compromised password.

Account overview dashboard

The Account overview dashboard provides an at-a-glance view of metrics for all the workspaces in your account. To navigate to the Account overview dashboard:

1. Log in to the Fastly control panel.
2. Go to Security > Next-Gen WAF > Dashboards.
3. From the workspaces bar, click the menu to the right of the workspace name and select your account name.

The Account overview dashboard contains the following cards:

• Request Volume: the number of requests your account receives, the number of requests that have at least one attack signal, and the number of requests that were blocked.

• Attack Requests: the number of malicious requests per workspace. The card displays a maximum of 10 workspaces.

• Blocked Requests: the number of requests that were blocked. The card displays a maximum of 10 workspaces.

  HINT: The Account overview page also contains the Workspace summary table, which lists the most frequent attack types and sources for all workspaces within the account, and the Top signals table, which contains signal data for top workspaces in the account.

Corp overview dashboard

The Corp Overview page displays cards that provide an at-a-glance view of metrics for all the sites in your corp. To navigate to the Corp Overview page, click the name of your corp in the upper left corner of the control panel. The Corp Overview page contains the following cards:

• Request Volume: the number of requests your corp receives, the number of requests that have at least one attack signal, and the number of requests that were blocked.
• Attack Requests: the number of malicious requests per site. The card displays a maximum of 10 sites.
• Blocked Requests: the number of requests that were blocked. The card displays a maximum of 10 sites.