About signals
Signals are labels that describe requests. Requests are tagged with signals based on the logic of your active rules. Per our data storage policy, the type of signals that requests are tagged with help determine which individual request data is stored and available in the web interface. Using our control panels, you can find and search for requests that have been tagged with a specific signal.
Limitations and considerations
When working with signals, keep the following things in mind:
The Essentials platform does not support custom signals.
Depending on the platform you have purchased, you can monitor signals for a site (also known as workspace) via our control panels.
| Essentials | Signals page | Signals page | | Professional | Monitor > Signals Dashboard | Not included | | Premier | Monitor > Signals Dashboard | Not included |
How signals work
When requests are made to your web application, the Next-Gen WAF agent uses your active rules to identify which requests need to be tagged with a signal and then tags them with the appropriate signal. The system then counts the number of requests that get tagged with a particular signal during one minute periods and makes this data available via time series graphs.
Signal type (e.g., attack, anomaly, informational, custom) determines what individual request data is stored and available in the control panel. For example, we store data from all requests that are tagged with the SQLI system signal because SQLI is an attack signal. We don't store individual request data for requests that haven't been tagged with a signal.
Types of signals
There are two main types of signals:
- Custom: signals that you create to track request behavior that is particular to your web applications. You can create custom signals at the corp (also known as account) or site (workspace) level.
- System: signals that we create to track common attacks, anomalies, and behaviors (e.g., requests to your API and account login and registration activity).
Filtering requests by signal
On the Requests page in the Next-Gen WAF control panel and the Fastly control panel, you can use the tag field to filter requests by a specific signal.
| Signal type | Description |
|---|---|
| System signal | The search syntax is tag:<system-signal>. Be sure to replace <system-signal> with the name of the system signal that you want to search for. |
| Corp (account) custom signal | The search syntax is tag:corp.<corp-custom-signal>. Be sure to replace <corp-custom-signal> with the name of the corp (account) custom signal that you want to search for. The Corp Signals page lists the custom signals that were created at the corp (account) level. |
| Site (workspace) custom signal | The search syntax is tag:site.<site-custom-signal>. Be sure to replace <site-custom-signal> with the name of the site (workspace) custom signal that you want to search for. The Site Signals page lists the custom signals that were created at the site (workspace) level. |
Monitoring signals
IMPORTANT: This section only applies to Next-Gen WAF customers with access to the Next-Gen WAF control panel.
The Next-Gen WAF control panel provides two different features that help you get a high-level view of the signals your requests are tagged with.
Monitoring top signals for a corp
Click the name of your corp in the upper left corner of the control panel to navigate to the Corp Overview page. The Top Signals section of the Corp Overview page surfaces signal data from your corp in the following tables:
- Attack Signals: displays data related to malicious requests.
- Anomaly Signals: displays data related to abnormal requests (e.g., requests containing malformed data and requests originating from known scanners).
- Corp Signals: displays data related to signals created at the corp level.
You can use a search bar to filter the tables by signal. The tables contain the following columns:
- Signal: the name of the signal.
- Total Requests: the number of requests that were tagged with the signal in your corp.
- Top sites: the sites that had the highest number of requests with that signal.
- Requests per Site: the number of requests tagged with that signal per site.
Monitoring all signals for a site
IMPORTANT: The Signals Dashboards page is only included with the Professional and Premier platforms. On the Essentials platform, you can monitor signals for a site via the Signals page.
The Signals Dashboard page lets you view charts that display time series data for all signals for a specific site. To access the Signals Dashboard page:
Log in to the Next-Gen WAF control panel.
From the Sites menu, select a site if you have more than one site.
- From the Monitor menu, select Signals Dashboard.
