Ⅲ. Nemesida WAF API | Nemesida WAF

When using the automatic installation script, file editing is not required.

PROXY = 'http://proxy.example.com:3128'

PROXY = 'http://<user>:<password>@proxy.example.com:3128'

# curl http://api.example.com:8080/nw-api/v2/get_dyn_settings --data 'key=%License key%'

Response format:

{
  "status": "success",
  "active": boolean,
  "nwaf_limit": [string, ...],
  "nwaf_ip_wl": [string, ...],
  "nwaf_ip_lm": [string, ...],
  "nwaf_geoip_mla_disable": [string, ...],
  "nwaf_host_wl": [string, ...],
  "nwaf_host_lm": [string, ...],
  "nwaf_url_wl": [string, ...],
  "nwaf_rfc_violation_wl": [string, ...],
  "nwaf_rfc_violation_lm": [string, ...],
  "nwaf_b64_decode_disable": [string, ...],
  "nwaf_mla_host_lm": [string, ...],
  "nwaf_ai_extra_host_wl": [string, ...],
  "nwaf_ai_extra_host_lm": [string, ...]
  "nwaf_bf_detect_host_lm": [string, ...],
  "nwaf_ddos_detect_host_lm": [string, ...],
  "nwaf_rmq_host_exclude": [string, ...],
  "nwaf_body_exclude": [string, ...],
  "nwaf_body_bin_exclude": [string, ...],
  "nwaf_post_body_exclude": [string, ...],
  "nwaf_put_body_exclude": [string, ...],
  "nwaf_openapi_ip_wl": [string, ...],
  "nwaf_openapi_ip_lm": [string, ...],
  "nwaf_openapi_url_wl": [string, ...],
  "nwaf_openapi_url_lm": [string, ...]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "active": true,
  "nwaf_limit": ["domain=example.com rate=5r/m block_time=600", ...],
  "nwaf_ip_wl": ["127.0.0.1", ...],
  "nwaf_ip_lm": ["127.0.0.1", ...],
  "nwaf_geoip_mla_disable": ["example.com", ...],
  "nwaf_host_wl": ["example.com", ...],
  "nwaf_host_lm": ["example.com", ...],
  "nwaf_url_wl": ["example.com/uploads.php", ...],
  "nwaf_rfc_violation_wl": ["*.example.com/login/index.php", ...],
  "nwaf_rfc_violation_lm": ["*.example.com/login/index.php", ...],
  "nwaf_b64_decode_disable": ["example.com/uploads/ z:BODY|URL", ...],
  "nwaf_mla_host_lm": ["example.com", ...],
  "nwaf_ai_extra_host_wl": ["example.com", ...],
  "nwaf_ai_extra_host_lm": ["example.com", ...]
  "nwaf_bf_detect_host_lm": ["example.com", ...],
  "nwaf_ddos_detect_host_lm": ["example.com", ...],
  "nwaf_rmq_host_exclude": ["example.com", ...],
  "nwaf_body_exclude": ["example.com/uploads.php", ...],
  "nwaf_body_bin_exclude": ["example.com/uploads.php", ...],
  "nwaf_post_body_exclude": ["example.com", ...],
  "nwaf_put_body_exclude": ["example.com", ...],
  "nwaf_openapi_ip_wl": ["127.0.0.1", ...],
  "nwaf_openapi_ip_lm": ["127.0.0.1", ...],
  "nwaf_openapi_url_wl": ["example.com/uploads.php", ...],
  "nwaf_openapi_url_lm": ["example.com/uploads.php", ...]
}

# curl http://api.example.com:8080/nw-api/v2/set_dyn_settings --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "active": true,
    "nwaf_limit": ["domain=example.com rate=5r/m block_time=600", ...],
    "nwaf_ip_wl": ["127.0.0.1", ...],
    "nwaf_ip_lm": ["127.0.0.1", ...],
    "nwaf_geoip_mla_disable": ["example.com", ...],
    "nwaf_host_wl": ["example.com", ...],
    "nwaf_host_lm": ["example.com", ...],
    "nwaf_url_wl": ["example.com/uploads.php", ...],
    "nwaf_rfc_violation_wl": ["*.example.com/login/index.php", ...],
    "nwaf_rfc_violation_lm": ["*.example.com/login/index.php", ...],
    "nwaf_b64_decode_disable": ["example.com/uploads/ z:BODY|URL", ...],
    "nwaf_mla_host_lm": ["example.com", ...],
    "nwaf_ai_extra_host_wl": ["example.com", ...],
    "nwaf_ai_extra_host_lm": ["example.com", ...]
    "nwaf_bf_detect_host_lm": ["example.com", ...],
    "nwaf_ddos_detect_host_lm": ["example.com", ...],
    "nwaf_rmq_host_exclude": ["example.com", ...],
    "nwaf_body_exclude": ["example.com/uploads.php", ...],
    "nwaf_body_bin_exclude": ["example.com/uploads.php", ...],
    "nwaf_post_body_exclude": ["example.com", ...],
    "nwaf_put_body_exclude": ["example.com", ...],
    "nwaf_openapi_ip_wl": ["127.0.0.1", ...],
    "nwaf_openapi_ip_lm": ["127.0.0.1", ...],
    "nwaf_openapi_url_wl": ["example.com/uploads.php", ...],
    "nwaf_openapi_url_lm": ["example.com/uploads.php", ...]
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/get_dyn_settings_hash --data 'key=%License key%'

Response example:

{'status': 'success', 'hash': '8ddd2b342d3190a866ee35afb249919a'}

# curl http://api.example.com:8080/nw-api/v2/set_dyn_settings --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "del": ""
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/v2/get_dyn_bl --data 'key=%License key%'

Response format:

{
  "status": "success",
  "active": boolean,
  "modify": integer,
  "bl": [string, ...]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "active": true,
  "modify": 1719335019,
  "bl": ["domain=example.com 1.1.1.1 api=yes", ...]
}

# curl http://api.example.com:8080/nw-api/v2/set_dyn_bl --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "active": true,
    "bl": [
      "domain=example.com 1.1.1.1",
      "2.2.2.2",
      "3.3.3.0/24",
      "4.4.4.4-5.5.5.5 api=yes"
    ]
  }
}'

api=yes -parameter to send blocking events when accessed from the specified IP address to the Nemesida WAF API.

Requests from the IP address 1.1.1.1 will be blocked only for the domain example.com. Requests from IP addresses 2.2.2.2, 3.3.3.0/24 and 4.4.4.4-5.5.5.5 will be blocked for all domains, including example.com.

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/get_dyn_bl_hash --data 'key=%License key%'

Response example:

{'status': 'success', 'hash': '8ddd2b342d3190a866ee35afb249919a'}

# curl http://api.example.com:8080/nw-api/v2/set_dyn_bl --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "del": ""
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/get_dyn_sync_ban --data 'key=%License key%'

Response format:

{
  "status": "success",
  "ban_data": [
    {
      "ip-address": string,
      "ttl": integer,
      "is_banned": boolean,
      "domain": string,
      "timestamp": integer
    },
    ...
  ]
}

or

{"status": "fail", "description": "%description%"}

ip-address – ip address;
ttl – remaining blocking time in seconds;
is_banned – the parameter indicates whether the IP address is blocked;
domain is a virtual host (domain name), access to which is blocked for the IP address. DEFAULT means that requests to any virtual host are blocked for an IP address;
timestamp – the date the IP address was added to the list in the format Unix Timestamp.

Response example:

{
  "status": "success",
  "ban_data": [
    {
      "ip-address": "127.0.0.1",
      "ttl": 30,
      "is_banned": true,
      "domain": "example.com",
      "timestamp": 1730871907
    },
    ...
  ]
}

# curl http://api.example.com:8080/nw-api/del_dyn_sync_ban --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "ip-address": "127.0.0.1"
}'

ip-address – The IP address to delete in IPv4/IPv6 format. It is allowed to use * to delete all IP addresses.

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/v2/get_dyn_wl --data 'key=%License key%'

Response format:

{
  "status": "success",
  "wl": [
    {
      "active": boolean,
      "modify": integer,
      "id": integer,
      "mz": string,
      "rl_id": string,
      "domain": string,
      "extension": string
    }
  ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "wl": [
    {
      "active": true,
      "modify": 1719335019,
      "id": 1,
      "mz": "ARGS",
      "rl_id": "1",
      "domain": "example.com",
      "extension": "$URL:/api/users/index.php|$BODY_X:id=[a-z0-9]+"
    }
  ]
}

# curl http://api.example.com:8080/nw-api/v2/set_dyn_wl --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "add": {
    "active": true,
    "rl_id": "1",
    "domain": "example.com",
    "mz": ["url", "args"],
    "extension": ["$URL:/api/users/index.php", "$BODY_X:id=[a-zA-Z0-9]+"]
  }
}'

Response example:

{"status": "success", "id": 20}

or

{"status": "fail", "description": "%description%"}

{... "active": true ...}

{... "rl_id": "1" ...}

{... "rl_id": "*" ...}

{... "domain": "example.com" ...}

{... "domain": "*" ...}

{... "mz": ["URL", "ARGS", "BODY", "HEADERS", "cookie", "user-agent", "content-type", "x-forward-for", "range", "referer", "NoMLA"] ...}

{... "extension": ["$BODY:abc|$Cookie_X:id=[a-z0-9]+"] ...}

Rashly adding signature exclusion rules is unsafe and can lead to omissions as well. Therefore, it is recommended to specify the conditions for triggering the rule as much as possible using clarifications.

# curl http://api.example.com:8080/nw-api/v2/set_dyn_wl --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "upd": {
    "id": 20,
    "mz": ["URL"]
  }
}'

id – The ID of the rule that is generated when creating an excluson rule.

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/get_dyn_wl_hash --data 'key=%License key%'

Response example:

{'status': 'success', 'hash': '8ddd2b342d3190a866ee35afb249919a'}

# curl http://api.example.com:8080/nw-api/v2/set_dyn_wl --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "del": {
    "id": 8
  }
}'

id – The ID of the rule that is generated when creating an excluson rule.

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/v2/get_dyn_erl --data 'key=%License key%'

Response format:

{
  "status": "success",
  "erl": [
    {
      "active": boolean
      "id": integer,
      "ip": string,
      "lm": boolean,
      "ua": string,
      "api": boolean,
      "url": string,
      "args": string,
      "body": string,
      "noban": boolean,
      "cookie": string,
      "domain": string,
      "modify": integer,
      "country": string,
      "referer": string,
      "block_tor": boolean,
      "no_cookie": boolean,
      "block_proxy": boolean,
      "other_headers": string
    }
  ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "erl": [
    {
      "active": true,
      "modify": 1730973337,
      "id": 100048,
      "ip": "127.0.0.1",
      "lm": true,
      "ua": "TW96aWxsYSA1LzA=",
      "api": true,
      "url": "L3VzZXJzL2xvZ2luLnBocA==",
      "args": "VVJM",
      "body": "c29tZV90ZXh0",
      "noban": true,
      "cookie": "aWQ9YW5ubWszNDU0R2Fmbmo2",
      "domain": "ZXhhbXBsZS5jb20=",
      "country": "UlU=|VVM=",
      "referer": "aHR0cDovL2V4YW1wbGUuY29t",
      "block_tor": true,
      "no_cookie": false,
      "block_proxy": true,
      "other_headers": "dXNlcl9JRA==:|YWRtaW4=|YWRtaW5pc3RyYXRvcg=="
    }
  ]
}

# curl http://api.example.com:8080/nw-api/v2/set_dyn_erl --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "add": {
    "active": true,
    "ip": ["|1.1.1.1"],
    "lm": true,
    "ua": ["|TW96aWxsYSA1LzA="],
    "api": true,
    "url": ["L3VzZXJzL2xvZ2luLnBocA=="],
    "args": ["VVJM"],
    "body": ["|dGVzdF9ib2R5"],
    "noban": true,
    "cookie": ["|aWQ9YW5ubWszNDU0R2Fmbmo2"],
    "domain": ["|example.com"],
    "country": ["|RU", "|US"],
    "referer": ["|aHR0cDovL2V4YW1wbGUuY29t"],
    "block_tor": true,
    "no_cookie": false,
    "block_proxy": true,
    "other_headers": ["dXNlcl9JRA==:|YWRtaW4=|YWRtaW5pc3RyYXRvcg=="]
  }
}'

# curl http://api.example.com:8080/nw-api/v2/set_dyn_erl --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "add": {
    "active": true,
    "ip": ["|!1.1.1.0/24"],
    "domain": ["&example.com"]
  }
}'

The request will be blocked if on example.com a request will be received from any IP address except 1.1.1.1-1.1.1.255.

Due to the peculiarities of request processing, the functionality is not designed to work with a large number of IP addresses. If you need to block requests for a list of IP addresses, use the “Blocked IPs” functionality.

# curl http://api.example.com:8080/nw-api/v2/set_dyn_erl --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "add": {
    "active": true,
    "ip": ["|1.1.1.1"],
    "domain": ["|example.com"],
    "other_headers": [
      "dGVzdC1oZWFkZXI=:YWJj"
    ]
  }
}'

The request will be blocked by the rule if example.com a request will be received from the IP address 1.1.1.1 and the header test-header contains the string abc.

# curl http://api.example.com:8080/nw-api/v2/set_dyn_erl --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "add": {
    "active": true,
    "country": ["|RU", "|CH"],
    "domain": ["|example.com"],
    "other_headers": [
      "dGVzdC1oZWFkZXI=:YWJj"
    ],
    "cookie": ["|!dGVzdF9jb29raWU="],
    "referer": ["|!aHR0cDovL2V4YW1wbGUuY29t"]
  }
}'

The request will be blocked by the rule if a request for example.com will be received from an IP address, from the region RU or CH, the header test-header contains the string abc, the header Cookie does not contain the string test_cookie and the header Referer does not contain http://example.com.

# curl http://api.example.com:8080/nw-api/v2/set_dyn_erl --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "add": {
    "active": true
    "ip": ["|1.1.1.1"],
    "other_headers": [
      "VGVzdC1GaWVsZA==:"
    ],
    "referer": ["|aHR0cDovL2V4YW1wbGUuY29tLw=="],
    "ua": ["|TW96aWxsYS81LjA="],
    "cookie": ["|dGVzdF9jb29raWU="],
    "body": ["|YmM9MyZjYz0x"],
    "args": ["|P3BhZ2U9Mw=="],
    "url": ["|aW50ZXJuYWx0ZXN0"],
    "domain": ["|example.com"],
    "api": false,
    "country": ["|RU", "|CH"]
  }
}'

The request will be blocked by the rule if a request for example.com will be received from the IP address 1.1.1.1, from the region RU or CH, which will contain:

Response example:

{"status": "success", "id": 100053}

or

{"status": "fail", "description": "%description%"}

{... "active": true ...}

{... "ip": ["|1.1.1.1"] ...}

{... "ip": ["|1.1.1.1", "|2.2.2.2-3.3.3.3", "|10.0.0.0/24"] ...}

{... "country": ["|RU", "|US"] ...}

{... "domain": ["|example.com", "|*.example.ru"] ...}

{... "url": ["|aW50ZXJuYWx0ZXN0", "|YWRtaW4vdXBsb2FkLnBocA==" ] ...}

{... "args": ["|P3BhZ2U9Mw==", "|dXNlcj1hZG1pbg=="] ...}

{... "body": ["|dGVzdF9ib2R5", "|dXNlcj1hZG1pbg=="] ...}

{... "cookie": ["|UEhQU0VTU0lE", "|dGVzdF9jb29raWU="] ...}

{... "no_cookie": true ...}

{... "ua": ["|TW96aWxsYS81LjA=", "|TW96aWxsYS81LjQ="] ...}

{... "referer": ["|aHR0cDovL2V4YW1wbGUuY29t", "|aHR0cDovL3dlYi5leGFtcGxlLmNvbQ=="] ...}

{... "other_headers": ["aGVhZGVyX25hbWU=:YWJj", "dGVzdC1oZWFkZXI=:YWJj"] ...}

{... "other_headers": ["aGVhZGVyX25hbWU=:"] ...}

{... "block_tor": true ...}

{... "block_proxy": true ...}

{... "api": true ...}

{... "lm": true ...}

{... "noban": true ...}

For all parameters (except for parameters that support the values true/false), it is allowed to use multiple values in one parameter using the logical operators of the conditions “not” (!), “and” (&), “or” (|). The operators have no priority and are executed in turn, from left to right.

When checking whether the extended request blocking rule is triggered, all fields except ip, country, api, lm, noban, block_tor and block_proxy are checked for the contents of the field from the blocking rule to be included in the checked request field.

For example, with "url": ["base64(/abc)"], the request with the occurrence of /abcd in the URL will be blocked.

The rule is triggered only if all the conditions specified in the rule are met, otherwise the request will be skipped.

Format:

{... "other_headers": ["base64(header_name):base64(header_value)", "base64(header_name):base64(header_value)" ...] ...}

base64(header_name) – header name in base64;
base64(header_value) – header value in base64.

For the other_headers field, the contents of the base64(header_name) sections and base64(header_value) are optional, but you must specify at least one of the sections. For example, if there is a header header_name, the contents of header_value of only this header will be checked, and if there is no header, the contents of all headers will be checked.

All elements of the list interact with each other according to the principle of logical “and” (&).

Example:

{... "other_headers": ["base64(example1_header):", "base64(example2_header):"] ...}

With this value, the request will be blocked if there are headers example1_header and example1_header with any values.

Each list item cannot contain more than 1 headers name, but each headers name can have several values, which are separated by logical operators of the conditions “not” (!), “and” (&), “or” (|).

Example:

{... "other_headers": ["base64(example_header):base64(abcd)"] ...}

With this value, the request will be blocked if there is abcd in the example_header header.

Example:

{... "other_headers": [":base64(abcd)"] ...}

With this value, the request will be blocked if there is abcd in any header.

If base64(header_name) is specified without a subsequent value, then the request will be blocked at any value of the header header_name (blocking by the presence of the header).

Example:

{... "other_headers": ["base64(example_header):"] ...}

Example:

{... "other_headers": ["base64(example1_header):base64(abc)", "base64(example2_header):base64(def)"] ...}

With this value, the request will be blocked if there are headers example1_header, which contains abc and example2_header, which contains def.

The logical operator can be used for the header name!!, which means that there is no header with that name in the request. Blocking the request will work if there is no header with the specified name among all the request headers. At the same time, the header value is ignored, even if it is present in the rule.

Example:

{... "other_headers": ["!!base64(example_header):"] ...}

Example:

{... "other_headers": ["base64(example_header):base64(abc)&base64(def)"] ...}

With this value, the request will be blocked if there is a example_header header that contains abc and def.

Example:

{... "other_headers": ["base64(example_header):!base64(abc)"] ...}

With this value, the request will be blocked if there is a example_header header that does not contain abc.

Example:

{... "other_headers": ["base64(example_header):!base64(a)&!base64(b)&!base64(c)"] ...}

With this value, the request will be blocked if there is a example_header header that does not contain a, b and c.

Example:

{... "other_headers": ["base64(example_header):!base64(a)|base64(b)"] ...}

With this value, the request will be blocked if there is a example_header header that does not contain a or contains b.

# curl http://api.example.com:8080/nw-api/v2/set_dyn_erl --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "upd": {
    "active": true
    "id": 1,
    "ip": ["|1.1.1.1"]
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/get_dyn_erl_hash --data 'key=%License key%'

Response example:

{'status': 'success', 'hash': '8ddd2b342d3190a866ee35afb249919a'}

# curl http://api.example.com:8080/nw-api/v2/set_dyn_erl --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "del": {
    "id": 1
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/v2/get_mlc_settings --data 'key=%License key%'

Response format:

{
  "status": "success",
  "active": boolean,
  "modify": integer,
  "main__ai_extra": boolean,
  "openapi__vhosts_list": [string, ...],
  "ddos__enable": boolean,
  "ddos__wl_ip": [string, ...],
  "ddos__wl_url": [string, ...],
  "ddos__interval": integer,
  "ddos__latest_only": boolean,
  "ddos__send_possible": boolean,
  "brute__enable": boolean,
  "brute__wl_ip": [string, ...],
  "brute__wl_host": [string, ...],
  "brute__brute_detect": [string, ...],
  "brute__flood_detect": [string, ...],
  "brute__bf_detect": [object, ...], 
  "brute__interval": integer,
  "brute__max_val": integer,
  "brute__latest_only": boolean,
  "brute__send_possible": boolean
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "active": true,
  "modify": 1719335019,
  "main__ai_extra": true,
  "openapi__vhosts_list": ["example.com", ...],
  "ddos__enable": true,
  "ddos__wl_ip": ["127.0.0.1", ...],
  "ddos__wl_url": ["example.com/feed", ...],
  "ddos__interval": 120,
  "ddos__latest_only": true,
  "ddos__send_possible": true,
  "brute__enable": true,
  "brute__wl_ip": ["127.0.0.1", ...],
  "brute__wl_host": ["example.com", ...],
  "brute__brute_detect": ["example.com/auth", ...],
  "brute__flood_detect": ["example.com/auth", ...],
  "brute__bf_detect": [{"url": "*", "brute": true, "flood": false, "zone": ["args", "body"], "condition": {"body": ["auth_form", "user_login"]}}, ...], 
  "brute__interval": 30,
  "brute__max_val": 10,
  "brute__latest_only": true,
  "brute__send_possible": true
}

# curl http://api.example.com:8080/nw-api/v2/set_mlc_settings --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "active": true,
    "main__ai_extra": true,
    "openapi__vhosts_list": ["example.com", ...],
    "ddos__enable": true,
    "ddos__wl_ip": ["127.0.0.1", ...],
    "ddos__wl_url": ["example.com/feed", ...],
    "ddos__interval": 120,
    "ddos__latest_only": true,
    "ddos__send_possible": true,
    "brute__enable": true,
    "brute__wl_ip": ["127.0.0.1", ...],
    "brute__wl_host": ["example.com", ...],
    "brute__brute_detect": ["example.com/auth", ...],
    "brute__flood_detect": ["example.com/auth", ...],
    "brute__bf_detect": [{"url": "*", "brute": true, "flood": false, "zone": ["args", "body"], "condition": {"body": ["auth_form", "user_login"]}}, ...], 
    "brute__interval": 30,
    "brute__max_val": 10,
    "brute__latest_only": true,
    "brute__send_possible": true
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/get_mlc_settings_hash --data 'key=%License key%'

Response example:

{'status': 'success', 'hash': '8ddd2b342d3190a866ee35afb249919a'}

# curl http://api.example.com:8080/nw-api/v2/set_mlc_settings --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "del": ""
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/v2/get_vhosts_list --data 'key=%License key%'

Response format:

{
  "status": "success",
  "vhosts_list": [string, ...]
}

Response example:

{
  "status": "success",
  "vhosts_list": ["example.com", ...]
}

# curl http://api.example.com:8080/nw-api/v2/set_vhosts_list --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "vhosts_list": ["example.com", "example.org"]
}'

vhosts_list – list of virtual hosts for which models will be created and applied.

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

When creating a list of virtual hosts, wildcard values are allowed. The model is applied in the following order of priority from highest to lowest:

• example.com — building and applying a domain model;
• .example.com — building and applying a model for the example.com domain and its subdomains;
• *.example.com — building and applying the model only for subdomains of the example.com domain, excluding the main domain;
• * — building and applying a model for all domains.

# curl http://api.example.com:8080/nw-api/v2/get_models_list_uri --data 'key=%License key%'

Response format:

{
  "status": "success",
  "models": [string, ...]
}

Response example:

{
  "status": "success",
  "models": ["example.com", ...]
}

# curl http://api.example.com:8080/nw-api/v2/del_models_uri --header "Content-type: application/json" --data '{
  "key": "%License key%",
  "model": "example.com"
}'

model – the name of the behavioral model which you want to delete.

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

1. Stop the Nemesida AI MLC service:

# service mlc_main stop

2. Move the file /opt/mlc/ml/backup/[vhost].d_[timestamp], where [timestamp] is the date of creation of a backup copy of the training sample created by Nemesida AI MLC before starting the model construction, in /opt/mlc/ml/[vhost].d. For example, for the model example.com:

# mv /opt/mlc/ml/backup/example.com.d_1613587613 /opt/mlc/ml/example.com.d

3. Start the training:

# curl http://api.example.com:8080/nw-api/v2/set_training_uri --header "Content-type: application/json" --data '{
  "key": "%License key%",
  "vhost": "example.com",
  "duration": 4,
  "complete": false
}'

4. Launch the Nemesida AI MLC service:

# service mlc_main start

# curl http://api.example.com:8080/nw-api/v2/rep_models_uri --header "Content-type: application/json" --data '{
  "key": "%License key%",
  "src_model": "example.com",
  "dst_model": "example.org"
}'

src_model is a virtual host whose behavioral model is being copied;
dst_model is a virtual host for which the model needs to be copied.

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/v2/get_training_uri --data 'key=%License key%'

Response format:

{
  "status": "success",
  "training": [
    {
      "vhost": string,
      "duration": integer,
      "complete": boolean,
      "progress": integer
    },
    ...
  ]
}

Response example:

{
  "status": "success",
  "training": [
    {
      "vhost": "example.com",
      "duration": 4,
      "complete": false,
      "progress": 95
    },
    ...
  ]
}

# curl http://api.example.com:8080/nw-api/v2/set_training_uri --header "Content-type: application/json" --data '{
  "key": "%License key%",
  "vhost": "example.com",
  "duration": 4,
  "complete": false
}'

duration – the training period in days.
complete – the training status of the model.

or

# curl http://api.example.com:8080/nw-api/v2/set_training_uri --header "Content-type: application/json" --data '{
  "key": "%License key%",
  "vhost": "example.com",
  "duration": 4
}'

or

# curl http://api.example.com:8080/nw-api/v2/set_training_uri --header "Content-type: application/json" --data '{
  "key": "%License key%",
  "vhost": "example.com",
  "complete": false
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/v2/set_training_uri --header "Content-type: application/json" --data '{
  "key": "%License key%",
  "vhost": "*.example.com",
  "duration": 4,
  "complete": false
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/v2/set_training_uri --header "Content-type: application/json" --data '{
  "key": "%License key%",
  "vhost": ".example.com",
  "duration": 2,
  "complete": false
}'

Executing a command with the value of the parameter complete: false allows you to start the process of retraining the model if it has been completed, and complete: true interrupts the learning process.

Before starting the model learning process, the virtual host must be added to the list of virtual hosts. The command that allows you to set a list of virtual hosts is given in the Nemesida AI MLC (Management commands) section.

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/get_mt_attack --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "startTime": 1730986421,
  "endTime": 1730987421,
  "limit": 100,
  "bt": [12, ...],
  "ip": ["127.0.0.1", ...],
  "cc": ["RU", ...],
  "vhost": ["example.com", ...],
  "method": ["GET", ...],
  "agent": ["MLA", ...],
  "mz": ["args", ...],
  "request_id": ["e19699c37b4c26f53a9fab3a24f573c8", ...],
  "bodyLimit": 1024,
  "url": ["example.com/index.php", ...],
  "args": ["abc", ...],
  "body": ["some_text", ...],
  "cookie": ["id=123jmci5", ...],
  "other_headers": ["user_ID=admin", ...],
  "referer": ["http://example.com", ...],
  "ua": ["Mozilla/5.0", ...],
  "search": ["abc", ...]
}'

Optional parameters:

• startTime and endTime – the start and end date in Unix Timestamp format for which information will be requested;
• limit – maximum number of displayed records;
• bt – blocking identifier. The search is carried out according to the strict correspondence of each element of the list;
• ip – IP address. The search is carried out according to the strict correspondence of each element of the list;
• cc – country code. The search is carried out according to the strict correspondence of each element of the list;
• vhost – virtual host, domain name. The search is carried out according to the strict correspondence of each element of the list;
• method – method of sending the HTTP request. The search is carried out according to the strict correspondence of each element of the list;
• agent – the name of the component that processed the request. The search is carried out according to the strict correspondence of each element of the list;
• mz – anomaly detection zone. The search is carried out according to the strict correspondence of each element of the list;
• request_id – the unique identifier of the request. The search is carried out according to the strict correspondence of each element of the list;
• bodyLimit – the size of the output request body;
• url – search for the occurrence of a string in the URL address. The search is performed by the occurrence of each item in the list;
• args – search for the occurrence of a string in the query arguments. The search is performed by the occurrence of each item in the list;
• body – search for the occurrence of a string in the request body. The search is performed by the occurrence of each item in the list;
• cookie – search for the occurrence of a string in the Cookie header. The search is performed by the occurrence of each item in the list;
• other_headers – search for the occurrence of a string in the headers (except for Cookie, User-Agent and Referer). The search is performed by the occurrence of each item in the list;
• referer – search for the occurrence of a string in the Referer header. The search is performed by the occurrence of each item in the list;
• ua – search for the occurrence of a string in the User-Agent header. The search is performed by the occurrence of each item in the list;
• search – search for the occurrence of a string for each element from the list among the request zones (url, args, body, cookie, other_headers, referer, ua). The search is performed by the occurrence of each item in the list.

The search for values transmitted in the form of a list is performed according to the principle of logical OR.

Response format:

{
  "status": "success",
  "count": integer,
  "waf_id": string,
  "attacks": [
    {
      "id": integer,
      "timestamp": integer,
      "request_id": string,
      "agent": string,
      "mz": array,
      "bt": integer,
      "ip": string,
      "cc": string,
      "vhost": string,
      "method": string,
      "url": string,
      "args": string,
      "body": string,
      "cookie": string,
      "other_headers": string,
      "ua": string,
      "referer": string,
      "mz_origin": string
    },
    ...
  ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "count": 104,
  "waf_id": 119835378,
  "attacks": [
    {
      "id": 1,
      "timestamp": 1730986421,
      "request_id": "e19699c37b4c26f53a9fab3a24f573c8",
      "agent": "MLA",
      "mz": ["args", ...],
      "bt": 12,
      "ip": "127.0.0.1",
      "cc": "RU",
      "vhost": "example.com",
      "method": "POST",
      "url": "/index.php",
      "args": "abc",
      "body": "some_text",
      "cookie": "id=123jmci5",
      "other_headers": "user_ID=admin",
      "ua": "Mozilla/5.0",
      "referer": "http://example.com",
      "mz_origin": "{'body': 'dW5pb24vKmFhYWFhKi9zZWxlY3Q='}"
    },
    ...
  ]
}

• id – ID of the database record;
• mz_origin – the original contents of the zones where the anomaly was detected.

# curl http://api.example.com:8080/nw-api/set_mt_fp --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "vhost": "example.com",
  "mz": "args",
  "mz_data": "abc"
}'

Required parameters:

• vhost – virtual host, domain name;
• mz – the area where the anomaly was detected;
• mz_data – the contents of the zone where the anomaly was detected. Exporting with an empty field value is not allowed.

Response example:

{"status": "success", "id": %ID of the created record%}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/del_mt_attack --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "id": [1, ...]
}'

Response example:

{"status": "success", "deleted": integer}

or

{"status": "fail", "description": "%description%"}

Required parameters:

• id – ID of the database record.

The values passed as a list are applied according to the principle of logical OR.

# curl http://api.example.com:8080/nw-api/get_mt_fp --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "limit": 100,
  "id": [1, ...],
  "vhost": ["example.com", ...]
}'

Optional parameters:

• limit – maximum number of output records;
• id – request ID. The search is carried out according to the strict correspondence of each element of the list;
• vhost – virtual host, domain name.The search is carried out according to the strict correspondence of each element of the list.

The search for values transmitted in the form of a list is performed according to the principle of logical OR.

Response format:

{
  "status": "success",
  "count": integer,
  "waf_id": string,
  "fp": [
    {
      "id": integer,
      "timestamp": integer,
      "vhost": string,
      "mz": string,
      "mz_data": string
    },
    ...
  ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "count": 25,
  "waf_id": 119835378,
  "fp": [
    {
      "id": 1,
      "timestamp": 173096451,
      "vhost": "example.com",
      "mz": "args",
      "mz_data": "abc"
    },
    ...
  ]
}

• id – ID of the database record;
• mz_data – the contents of the exported request zone.

# curl http://api.example.com:8080/nw-api/del_mt_fp --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "id": [1, ...]
}'

Response example:

{"status": "success", "deleted": 3}

or

{"status": "fail", "description": "%description%"}

Required parameters:

• id – ID of the database record.

The values passed as a list are applied according to the principle of logical OR.

# curl http://api.example.com:8080/nw-api/get_openapi_schemas --header 'Content-type: application/json' --data '{"key": "%License key%"}'

Response format:

{
  "schemas": [
    {
      "schema_name": string,
      "schema": string
    },
    ...
  ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "schemas": [
    {
      "schema_name": "example.com",
      "schema": "b3BlbmFwaSBzY2hlbWEgaW4gYmFzZTY0"
    },
    ...
  ]
}

# curl http://api.example.com:8080/nw-api/get_openapi_schemas_hash --header 'Content-type: application/json' --data '{"key": "%License key%"}'

Response example:

{'status': 'success', 'hash': '8ddd2b342d3190a866ee35afb249919a'}

# curl http://api.example.com:8080/nw-api/set_openapi_schema --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "schema_name": "example.com",
    "schema": "b3BlbmFwaSBzY2hlbWEgaW4gYmFzZTY0"
  }
}'

To work correctly, the domain name specified in the specification must be used as the name of the specification. For example, if the specification specifies the servers parameter with the value:

"servers": [
  {
    "url": "http://example.com"
  }
]

Strict matching and wildcard values are allowed: *, example.com, .example.com, *.example.com.

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/set_openapi_url --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "url": [
    "example.com/admin",
    "example.com/admin/info",
    "example.com/v1/client/info"
  ]
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/get_openapi_url_hash --header 'Content-type: application/json' --data '{"key": "%License key%"}'

Response example:

{'status': 'success', 'hash': '8ddd2b342d3190a866ee35afb249919a'}

# curl http://api.example.com:8080/nw-api/set_openapi_schema --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "schema_name": "example.com",
    "old_name": "example.ru"
  }
}'

To work correctly, the domain name specified in the specification must be used as the name of the specification. For example, if the specification specifies the servers parameter with the value:

"servers": [
  {
    "url": "http://example.com"
  }
]

Strict matching and wildcard values are allowed: *, example.com, .example.com, *.example.com.

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/set_openapi_schema --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "del": {
    "schema_name": "example.com"
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/get_openapi_schema_paths --header 'Content-type: application/json' --data '{"key": "%License key%"}'

Nemesida AI MLC analyzes requests and automatically generates specifications for each request paths based on the corresponding list of virtual hosts.

Response format:

{
  "paths": [
    {
      "schema_name": string,
      "url": string,
      "schema": string
    },
    ...
  ]
}

or

{"paths": []}

Response example:

{
  "paths": [
    {
      "schema_name": "example.com",
      "url": "/index/",
      "schema": "b3BlbmFwaSBzY2hlbWEgaW4gYmFzZTY0"
    },
    ...
  ]
}

An example of a response with the decoded content of the specification:

{
  "paths": [
    {
      "schema_name": "example.com",
      "url": "/url_1/",
      "schema": {
        "example.com": {
          "/url_1/": {
            "post": {
              "requestBody": {
                "content": {
                  "*/*": {
                    "schema": {
                      "type": "object",
                      "properties": {
                        "id": {
                          "type": "integer"
                        },
                        "order": {
                          "type": "string"
                        }
                      },
                      "required": [
                        "id",
                        "order"
                      ]
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    ...
  ]
}

# curl http://api.example.com:8080/nw-api/set_openapi_exclude_paths --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "exclude_paths": ["/url_1/", "/url_2/"]
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/get_openapi_exclude_paths --header 'Content-type: application/json' --data '{"key": "%License key%"}'

Response format:

{
  "exclude_paths": [string, ...]
}

Response example:

{
  "exclude_paths": ["/url_1/", ...]
}

# curl http://api.example.com:8080/nw-api/get_openapi_exclude_paths_hash --header 'Content-type: application/json' --data '{"key": "%License key%"}'

Response example:

{'status': 'success', 'hash': '8ddd2b342d3190a866ee35afb249919a'}

# curl http://api.example.com:8080/nw-api/nginx/get_nginx --data 'key=%License key%'

Response format:

{
  "status": "success",
  "configuration": [
    {
      "active": boolean,
      "resolver": string,
      "limit_req_zone": [string, ...],
      "real_ip_header": string,
      "resolver_timeout": string,
      "set_real_ip_from": [string, ...],
      "client_max_body_size": string
    }
  ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "configuration": [
    {
      "active": true,
      "resolver": "127.0.0.1 [::1]:5353 valid=30s",
      "limit_req_zone": ["$binary_remote_addr zone=mylimit_1:10m rate=10r/s", ...],
      "real_ip_header": "X-Forwarded-For",
      "resolver_timeout": "30s",
      "set_real_ip_from": ["192.168.1.0/24", ...],
      "client_max_body_size": "100m"
    }
  ]
}

# curl http://api.example.com:8080/nw-api/nginx/set_nginx --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "active": true,
    "resolver": "127.0.0.1 [::1]:5353 valid=30s",
    "resolver_timeout": "30s",
    "set_real_ip_from": [
      "192.168.1.0/24",
      "192.168.2.1"
    ],
    "real_ip_header": "X-Forwarded-For",
    "client_max_body_size": "100m",
    "limit_req_zone": [
      "$binary_remote_addr zone=mylimit_1:10m rate=10r/s",
      "$binary_remote_addr zone=mylimit_2:10m rate=10r/s"
    ]
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/nginx/get_nginx_hash --data 'key=%License key%'

Response example:

{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}

# curl http://api.example.com:8080/nw-api/nginx/set_nginx --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "resolver": null,
    "resolver_timeout": null,
    "set_real_ip_from": null,
    "real_ip_header": null,
    "client_max_body_size": null,
    "limit_req_zone": null
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/nginx/get_vhost --data 'key=%License key%'

Response format:

{
  "status": "success",
  "configuration": [
    {
      "active": boolean,
      "name": string,
      "root": string,
      "index": string,
      "listen": [string, ...],
      "add_header": {string, ...},
      "error_page": {string, ...},
      "locations": [
        {
          "location": string,
          "pass_type": string,
          "path": string,
          "index": string,
          "add_header": {string, ...},
          "error_page": {string, ...},
          "limit_req": string,
          "limit_req_status": integer
        },
        ...
      ],
      "server_name": string,
      "ssl_ciphers": string,
      "dhparam_name": string,
      "ssl_protocols": string,
      "certificate_name": string,
      "ssl_session_timeout": string
    }
  ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "configuration": [
    {
      "active": true,
      "name": "example.com",
      "root": "/var/www/site",
      "index": "index index.html index.php",
      "listen": ["localhost:443 default_server ssl http2", ...],
      "add_header":{
        "Content-type": "text/html; charset=utf-8",
        ...
      },
      "error_page": {
        "404 502": "=200 /404.html",
        ...
      },
      "locations": [
        {
          "location": "/static_1",
          "pass_type": "root",
          "path": "/var/www/html",
          "index": "index index.html index.php",
          "add_header":{
            "Content-type": "text/html; charset=utf-8",
            ...
          },
          "error_page": {
            "404 502": "=200 /404.html",
            ...
          },
          "limit_req": "zone=mylimit_1 burst=20 nodelay",
          "limit_req_status": 444
        },
        ...
      ],
      "server_name": "www.example.com example.com",
      "ssl_ciphers": "AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5",
      "dhparam_name": "dhparam",
      "ssl_protocols": "TLSv1 TLSv1.1 TLSv1.2",
      "certificate_name": "SSL",
      "ssl_session_timeout": "10m"
    }
  ]
}

# curl http://api.example.com:8080/nw-api/nginx/set_vhost --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "active": true,
    "name": "%Configuration name%",
    "listen": [
      "localhost:80 default_server",
      "[::1]:443 default_server ssl http2"
    ],
    "server_name": "www.example.com example.com",
    "certificate_name": "%name%",
    "dhparam_name": "%name%",
    "ssl_session_timeout": "10m",
    "ssl_ciphers": "AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5",
    "ssl_protocols": "TLSv1 TLSv1.1 TLSv1.2",
    "root": "/var/www/site",
    "index": "index.php index.html",
    "add_header": {
      "Content-Encoding": "gzip",
      "Content-type": "text/html; charset=utf-8"
    },
    "error_page": {
      "404 502": "=200 /404.html",
      "504": "=200 @bad_gateway"
    },
    "locations": [
      {
        "location": "/static_1",
        "pass_type": "root",
        "path": "/var/www/html",
        "index": "index.php",
        "add_header": {
          "Content-Encoding": "gzip",
          "Content-type": "text/html; charset=utf-8"
        },
        "error_page": {
          "504": "=200 @bad_gateway",
          "404 502": "=200 /404.html"
        },
        "limit_req": "zone=mylimit_1 burst=20 nodelay",
        "limit_req_status": 444
      },
      {
        "location": "/static_2",
        "pass_type": "alias",
        "path": "/var/www/static_2",
        "autoindex": "on",
        "limit_req": "zone=mylimit_1 burst=20 nodelay",
        "limit_req_status": 444
      },
      {
        "location": "/abc_1",
        "pass_type": "proxy_pass",
        "proxy_pass": "http://main_proxy",
        "proxy_http_version": 1.0,
        "proxy_set_header": {
          "X-Real_IP": "$remote_address",
          "Host": "$http_host"
        },
        "proxy_connect_timeout": "60s",
        "proxy_send_timeout": "60s",
        "proxy_read_timeout": "60s",
        "proxy_intercept_errors": "on",
        "limit_req": "zone=mylimit_1 burst=20 nodelay",
        "limit_req_status": 444
      },
      {
        "location": "/abc_2",
        "pass_type": "memcached_pass",
        "memcached_pass": "memc_upstream",
        "limit_req": "zone=mylimit_1 burst=20 nodelay",
        "limit_req_status": 444
      }
    ]
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/nginx/get_vhost_hash --data 'key=%License key%'

Response example:

{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}

# curl http://api.example.com:8080/nw-api/nginx/set_vhost --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "name": "%Configuration name%",
    "listen": null,
    "server_name": null,
    "certificate_name": null,
    "dhparam_name": null,
    "ssl_session_timeout": null,
    "ssl_ciphers": null,
    "ssl_protocols": null,
    "root": null,
    "index": null,
    "add_header": null,
    "error_page": null,
    "locations": null
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/nginx/set_vhost --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "del": {
    "name": "%Configuration name%"
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/nginx/get_upstream --data 'key=%License key%'

Response format:

{
  "status": "success",
  "configuration": [
    {
      "name": string,
      "balancing_method": string
      "servers": [
        {
          "server": string,
          "weight": integer,
          "max_fails": integer,
          "fail_timeout": string,
          "backup": boolean,
          "down": boolean
        },
        ...
      ]
    }
  ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "configuration": [
    {
      "name": "upstream_main",
      "balancing_method": "ip_hash"
      "servers": [
        {
          "server": "backend1.example.com",
          "weight": 3,
          "max_fails": 5,
          "fail_timeout": "60s",
          "backup": false,
          "down": true
        },
        ...
      ]
    }
  ]
}

# curl http://api.example.com:8080/nw-api/nginx/set_upstream --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "name": "%Configuration name%",
    "balancing_method": "ip_hash",
    "servers": [
      {
        "server": "backend1.example.com",
        "weight": 3
      },
      {
        "server": "127.0.0.1:8080",
        "fail_timeout": "60s"
      },
      {
        "server": "192.0.2.1",
        "max_fails": 5
      },
      {
        "server": "backend3.example.com",
        "weight": 3,
        "fail_timeout": "60s",
        "max_fails": 5
      },
      {
        "server": "backend4.example.com"
      },
      {
        "server": "backend5.example.com",
        "backup": true
      },
      {
        "server": "backend4.example.com",
        "down": true
      }
    ]
  }
}'

Response example:v

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/nginx/set_upstream --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "name": "%Configuration name%",
    "balancing_method": null,
    "servers": null
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/nginx/get_upstream_hash --data 'key=%License key%'

Response example:

{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}

# curl http://api.example.com:8080/nw-api/nginx/set_upstream --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "del": {
    "name": "%Configuration name%"
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/nginx/get_certificate --data 'key=%License_key%'

Response format:

{
  "status": "success",
  "configuration": [
    {
      "name": string,
      "certificate": string,
      "certificate_key": string
    }
  ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "configuration": [
    {
      "name": "SSL",
      "certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS...",
      "certificate_key": "LS0tLS1CRUdJTiBQUklWQVRF..."
    }
  ]
}

# curl http://api.example.com:8080/nw-api/nginx/set_certificate --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "name": "%Configuration name%",
    "certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURVekNDQWpzQ0ZGei9jNjhLYk9USnlYOWpibWZMbjdmK1YwdWtNQTBHQ1NxR1NJYjNEUUVCQ3dVQU1IOHgKQ3pBSkJnTlZCQVlUQWtGVk1RNHdEQVlEVlFRSURBVkJVMEZGUmpFTk1Bc0dBMVVFQnd3RVQzSmxiREVSTUE4RwpBMVVFQ2d3SVUxTlNSMEZCUldZeERqQU1CZ05WQkFzTUJYTnlaWFJuTVE0d0RBWURWUVFEREFWM1pUUm1aekVlCk1Cd0dDU3FHU0liM0RRRUpBUllQWVdSdGFXNUFZV1J0YVc0dVkyOXRNQjRYRFRJek1EY3hOekV3TlRZME0xb1gKRFRJMk1EUXhNVEV3TlRZME0xb3dUVEVMTUFrR0ExVUVCaE1DUTBFeERUQUxCZ05WQkFnTUJFNXZibVV4Q3pBSgpCZ05WQkFjTUFrNUNNUTB3Q3dZRFZRUUtEQVJPYjI1bE1STXdFUVlEVlFRRERBcGxlR0Z0Y0d4bExuSjFNSUlCCklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFySitBMkZ3cHFjMDhNVnRhVzZKeUsvbDkKQy9NWXFJRXZtRjZvdUt5V01ZRWFGMmlPK0l2VG1pN2hETkxQakR2ekhKRHJMYTZycjhJMkdMN0Nxdi9tdkN5NQpKZVBaSVZxeU9PQ0NLUEJFVXFrUkl4NUwvQ0hLMnVieHlxL1ZIWUExRysxanVqNzNINXZqUHM4anRyeFFNVG5OCkNacVBycmdoOTRlU0ViRmpER2JyZGlGSFpURmwyT01QdTlBVEJoRjF3dStwYS8yN3BJVm91S21BTnVTa0pTaUoKM29wRTkzZFJDYkUvWVhoTjJKTlNjdmdzcjBVbXBRd2t5VDJ4bGVKbHV0Sm5PZkZiK1NsdWFHVlloOUtncEwrcQorN2x3MFk0OEtYNnJGeXUzNko1RjBxNUN6T1hoMS9BZWFneStJQTdGanVSOU9tTFEvQVlwSGE1QmZMK0Fid0lECkFRQUJNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUNnV1VGTVZrMkVSaHF3WGpBT0YxVCt1cWZJM3pKZkVrTHAKYlZieW90d2dRMnZPU2VZdlAyU1dqdjZCMDExZEFONWNYTUIvOFhOVEdhdUNSajN1cEtTTUtvd1JaY1hjdUlKMApocUNDc01JZGw1bDFBQVFJWCtPTTJTeEpKdHVRK0dkWlhkQ294RStzN20zSHNCQ3UwbWRzY3doU0hGSnRmbXRhCit6eFJ4VmY5QkU3NDJSUE5ydXNFZmxwdVQ2Rm14QkpMUy9WYzVLOWtQMngwdjZQTjZYMUF4M09vRGhrQ3Nma2cKeXpwSFhtK3J1ZWJmcnNvcFdwUzJBM083T09CRk1lTVhZeHl3WjJUR2hmanh3R3ZGZml0ZnhFNnpTUnZnQ1A5WQphaUM5RUlMSXpodUdDNDFXNFFZYTJBUzNoaVF4Qms0eDcyeGZ1cXpmc212OE5Zd0lzY3BxCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K",
    "certificate_key": "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQ3NuNERZWENtcHpUd3gKVzFwYm9uSXIrWDBMOHhpb2dTK1lYcWk0ckpZeGdSb1hhSTc0aTlPYUx1RU0wcytNTy9NY2tPc3RycXV2d2pZWQp2c0txLythOExMa2w0OWtoV3JJNDRJSW84RVJTcVJFakhrdjhJY3JhNXZIS3I5VWRnRFViN1dPNlB2Y2ZtK00rCnp5TzJ2RkF4T2MwSm1vK3V1Q0gzaDVJUnNXTU1adXQySVVkbE1XWFk0dys3MEJNR0VYWEM3NmxyL2J1a2hXaTQKcVlBMjVLUWxLSW5laWtUM2QxRUpzVDloZUUzWWsxSnkrQ3l2UlNhbERDVEpQYkdWNG1XNjBtYzU4VnY1S1c1bwpaVmlIMHFDa3Y2cjd1WERSamp3cGZxc1hLN2ZvbmtYU3JrTE01ZUhYOEI1cURMNGdEc1dPNUgwNll0RDhCaWtkCnJrRjh2NEJ2QWdNQkFBRUNnZ0VBWENKSjM3RFpIK01GeElZd3BRWUFFQTU2T24yR1pMR0cyTGwxTGhRWG1kYUIKT1lzNSs5aU5tUlo2VWFEVzI4OUhnN0NwaFZsY0UxUUNFWlVIUzhPSHdGblNmREd2TzBrd0pJRlhsMGdkLzB4egpkQjRBaWxMeTlZRWIvb1Y0cHVVOTgyanh1SDlRNE5NUUovN2czZkNHa0s5OEN5c3VreDkrS2FKM1NQQTNvRzhSCnlLNDVKckRZK1l4WktLNS9EZmtrZlRGdXF6TDkxSzdIcFdBKzkxc3FnRUM5c0hqTzJyME9KUmlEK1lFekFLZisKb0hsSHZmTjhrblBSTDZRMWFJaUgvL1o3S053YTlmOHFvK0prZmR3bExaS21KS21ScEtqQUppMWd1ckZSaklzUgpQeU5sTm43VHljQmZUKzIvS3hoNm1pR2F1UWg1ZC9saXg2QVJLMjhTdVFLQmdRRFNSQkxmQ3RiYWR2OThtWWJsCnREUS95OUZoSWo0WHJML2xPZVhJaEZEbFpKc3U4R3dpSzZZczNqWFQvOEhwUlZUbll6TkdtdUhUNk5Pb1lkakoKWk5IWDFINHlCT2xMV3oyQ3RvNk1aMWJSWkVlcHplV29GM2txMWc2TmNabmJYdk4xNmNhSXJzTG9LY0NYQ2h6UwpFQ245TytrS1FBYk1PL3d2WXVMUWJpRlU4d0tCZ1FEU0syc09WWGIrbm83MVZmR1BUSDJpQUV2bWxFRlZwVkNhClNxMmtWZE9hQkVOR3BnWnRwNmZ4Lzh5bUlPbGczWnZpQ2JQZnVhK2FGOENqVUYzaGRkcDFRdTI3RjdCaGswbGUKUXNrRGVBaEU4KzVxWWZtWEUwZUo1dE11bmtYUHM2b2o3eHRTTlR2c01CZEwwK3AwVUtia0EzaDVvLzlqdytkLwp2OHRpYytKMWxRS0JnQ1RNd1RqRUh1SlJYVm1qVFJhNnVVSkpHN1lTVmlleWxrczZITnRCUFI5SXdsZ3V2OTRqCklZeE12OE1BeWlGWGZ3cVlOQXN4WkVEQVNQcjVWUVc2WFhlV3V4ZHFBS0t0cjFCSFB4K1hubnc3UHNlYlA0eHgKdjBVZC9hSUh0ZFBOQkhNb25SU2k4WDNNZ09adVlLanJKMDRveEJxRkppdHNmRENXNy9kbXJ2SzlBb0dBZVR4OApsQmN1L25BZXpWMVhiQzlXcFpZQU1ySEJBcFBMYkVXNTV2dHZoZ0FCZ3dhUTNMNkMvZkZ1YjBLNi9acTRxbXFvCmJWMWk4OFBSNXlPY0ZFdjB5Z0hpdXpOT0Z1dHN2a2hPUm9iK1ZqQlVqdCtYcDlPQ1NBVjBPd2NvQkVtQzB4bkMKSytqemVTckF0WWc0VGdLY1V4bkJiSUh5OSt6eFpOc1JpdWlJY1FVQ2dZQUpQN3pBck5IQ0FVYWwwOUQvQVFjbAppMGVxQnkvZ2xJOXlIS1BVcDFlU1BnUnhSL3Y4ZVBPOGM2azA5YkM3bk1TeDQ5bEVWWnhvT1lkM3ZkSyszQXZCCnByZWZscnZXTk5hSWhBMHdsZTRjWXdObHlMZDVKRU5zeDZ1RTBwNUd4UVRLeEZNUE16L2JaSlU0YzZkUWsyUDIKNFdVME1SLzRLdU9KMjJOZWJObmlWUT09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K"
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/nginx/get_certificate_hash --data 'key=%License key%'

Response example:

{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}

# curl http://api.example.com:8080/nw-api/nginx/set_certificate --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "del": {
    "name": "%Configuration name%"
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/nginx/get_dhparam --data 'key=%License key%'

Response format:

{
  "status": "success",
  "configuration": [
    {
      "name": string,
      "dhparam": string
    }
  ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "configuration": [
    {
      "name": "dhparam",
      "dhparam": "LS0tLS1CRUdJTiBESCBQQVJBTUVURVJT..."
    }
  ]
}

# curl http://api.example.com:8080/nw-api/nginx/set_dhparam --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "name": "%Configuration name%",
    "dhparam": "LS0tLS1CRUdJTiBESCBQQVJBTUVURVJTLS0tLS0KTUlHSEFvR0JBT1lpNi9OQmljaHU5UDlPS3BpZ1RLQTB4WjNUWnZKQ3pWNzMvWkxCMkgvRFFzc2xUNWgyWEltcQpiazR0SHRGc2ViNDU0S29IR3JoM2FCbzFmcXB5REJQMDcxR0M3eE12c2xUQXVBanVIRmFVckd6NVNDTWRRN3A3CnJvaWNJdExNWE5razQ1WWpzazRPZjZHVXhDZXQ1MkdqSHo3a01yemdvbUtWTldjdU5BRGJBZ0VDCi0tLS0tRU5EIERIIFBBUkFNRVRFUlMtLS0tLQo="
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/nginx/get_dhparam_hash --data 'key=%License key%'

Response example:

{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}

# curl http://api.example.com:8080/nw-api/nginx/set_dhparam --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "del": {
    "name": "%Configuration name%"
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/get_event --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "startTime": 1234567891,
  "endTime": 1987654321,
  "limit": 100,
  "offset": 1,
  "level": ["info", ...],
  "ip": ["1.1.1.1", ...],
  "uuid": ["198be506d69ba8a9bdbcf87b22ef5bc", ...],
  "agent": ["dyn", ...],
  "category": ["settings", ...]
}'

Optional parameters:

• startTime – the starting date in the format Unix Timestamp for which information will be requested;
• endTime – the end date in the format Unix Timestamp, for which information will be requested;
• limit – maximum number of display records;
• offset – offset for the display of subsequent records;
• level – message severity level;
• ip – IP address of the server where the component is installed;
• uuid – id of the server where the component is installed;
• agent – component name;
• category – event category.

The added parameters are combined according to the logical “and” (&) principle, and their values are combined according to the logical “or” (|) principle.

Response format:

{
  "status": "success",
  "count": integer,
  "waf_id": string,
  "events": [
    {
      "id": integer,
      "ip": string,
      "uuid": string,
      "agent": string,
      "level": string,
      "category": string,
      "timestamp": integer,
      "description": string
    }
  ]
}

Response example:

{
  "status": "success",
  "count": 28,
  "waf_id": "1674726761",
  "events": [
    {
      "id": 2798306,
      "ip": "1.1.1.1",
      "uuid": "bd4f447720189ca3c5a42e1395fa6021",
      "agent": "dyn",
      "level": "debug",
      "category": "nginx",
      "timestamp": 1688404169,
      "description": "This is log 1"
    }
  ]
}

• startTime – the starting date in the format Unix Timestamp for which information will be requested;
• endTime – the end date in the format Unix Timestamp, for which information will be requested.

Number of records:

• limit – maximum number of display records;
• offset – offset for the display of subsequent records. If the value is 0 and the value is limit 100, records with the sequence number 1-100 will be display, if the value is 1, records with the sequence number 101-200, etc. It is not possible to use the parameter without specifying the maximum number of display records (limit).

Ranking of events:

• level – event severity level;
  • debug – events with debugging information;
  • info – informational messages about the status of the component;
  • warn – warnings about a potential problem in the operation of the component;
  • error – error messages in the operation of the component;
  • fatal – messages about critical errors in the operation of the component, leading to a malfunction.
• category – event category:
  • Filtering node:
    • auth – events related to the verification of the program key, plan, etc.;
    • os – operating system interaction events (memory, disk);
    • network – network-related events (connection cannot be established, dispatches, timeouts, interruptions, socket/port start/stop);
    • api – events related to interaction with the Nemesida WAF API;
    • settings – events related to module settings;
    • nginx – events related to interaction with Nginx (inconsistency of settings required for the operation of the filtering node, violations of the RFC);
    • signature – events related to signature analysis;
    • clamav – events related to interaction with ClamAV;
    • mla – events related to interaction with Nemesida AI MLA;
    • mlc – events related to interaction with Nemesida AI MLC;
    • rabbitmq – events related to interaction with RabbitMQ;
    • autoban – events related to the automatic blocking mechanism;
    • geo – events related to the GeoIP functionality;
    • openapi – events related to the operation of OpenAPI;
    • parsing – events related to data decoding and normalization;
    • analysis – events related to request processing, but not included in any group (signature, ml, openapi, etc.);
    • misc – events that are not included in any category (for example, the display of information about UUID, WAF ID, number of signatures, etc.).
  • Nemesida AI MLA:
    • auth – events related to the verification of the program key, plan, etc.;
    • os – operating system interaction events (memory, disk);
    • network – network-related events (connection cannot be established, dispatches, timeouts, interruptions, socket/port start/stop);
    • api – events related to interaction with the Nemesida WAF API;
    • settings – events related to module settings;
    • dyn – events related to interaction with the filtering node;
    • ml – events related to the work of machine learning;
    • geo – events related to the GeoIP functionality;
    • mgmt – events related to the functionality of the service management interface;
    • openapi – events related to the operation of OpenAPI;
    • parsing – events related to data decoding and normalization;
    • analysis – events related to request processing, but not included in any group (signature, ml, openapi, etc.);
    • misc – events that are not included in any category (for example, the display of information about UUID, WAF ID, etc.).
  • Nemesida AI MLC:
    • auth – events related to the verification of the program key, plan, etc.;
    • os – operating system interaction events (memory, disk);
    • network – network-related events (connection cannot be established, dispatches, timeouts, interruptions, socket/port start/stop);
    • api – events related to interaction with the Nemesida WAF API;
    • settings – events related to module settings;
    • dyn – events related to interaction with the filtering node;
    • rabbitmq – events related to interaction with RabbitMQ;
    • ml – events related to the work of machine learning;
    • geo – events related to the GeoIP functionality;
    • bf – events related to the work of Brute-force/Flood analysis;
    • ddos – events related detection of DDoS attacks;
    • openapi – events related to the operation of OpenAPI;
    • parsing – events related to data decoding and normalization;
    • analysis – events related to request processing, but not included in any group (signature, ml, openapi, etc.);
    • misc – events that are not included in any category (for example, the display of information about UUID, WAF ID, etc.).
• Nemesida WAF Scanner:
  • auth – events related to the verification of the program key, plan, etc.;
  • os – operating system interaction events (memory, disk);
  • network – network-related events (connection cannot be established, dispatches, timeouts, interruptions, socket/port start/stop);
  • api – events related to interaction with the Nemesida WAF API;
  • settings – events related to module settings;
  • scan – events related to the operation of the component;
  • %ModuleName% – events related to the operation of a specific scanning module;
  • parsing – events related to data decoding and normalization;
  • db – events related to database interaction;
  • misc – events that are not included in any category (for example, the display of information about UUID, WAF ID, etc.).

Components identification:

• ip – IP address of the server where the component is installed;
• uuid – id of the server where the component is installed;
• agent – component name:
  • dyn – Filtering node;
  • mla – Nemesida AI MLA;
  • mlc – Nemesida AI MLC;
  • cabinet – Nemesida WAF Cabinet;
  • nws – Nemesida WAF Scanner.

# curl http://api.example.com:8080/nw-api/del_event --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "timestamp": 1686655813,
  "id": [1, 2, 3],
  "ip": [
    "1.1.1.1",
    "2.2.2.2"
  ],
  "uuid": [
    "198be506d69ba8a9bdbcf87b22ef5bc",
    "198be506d69ba8a9bdbcf87b22ef5bb"
  ],
  "agent": [
    "dyn",
    "mla"
  ],
  "level": [
    "info",
    "error"
  ],
  "category": [
    "os",
    "api"
  ]
}'

Optional parameters:

• timestamp – the date in the format Unix Timestamp before which (inclusive) all events will be deleted;
• id – ID of records to be deleted;
• ip – IP address of the server where the component is installed;
• uuid – id of the server where the component is installed;
• agent – component name;
• level – message severity level;
• category – event category.

The added parameters are combined according to the logical “and” (&) principle, and their values are combined according to the logical “or” (|) principle.

All events older than 90 days are automatically deleted.

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/get_attack --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "startTime": 1677211703,
  "endTime": 1677211703,
  "limit": 100,
  "offset": 1,
  "bt": [1, ...],
  "ip": ["1.1.1.1", ...],
  "cc": ["RU", ...],
  "vhost": ["example.com", ...],
  "method": ["post", ...],
  "rule_id": [1, ...],
  "signatureType": ["sqli", ...],
  "mz": ["args", ...],
  "request_id": ["b2afdac78f17e017dd2b6dfafcb5a974", ...],
  "group_id": ["b2afdac78f17e017dd2b6dfafcb5a974", ...],
  "blocked": true,
  "possible": true,
  "bodyLimit": 1024,
  "url": ["/uploads.php", ...],
  "args": ["abc", ...],
  "body": ["abc", ...],
  "cookie": ["abc", ...],
  "other_headers": ["abc", ...],
  "referer": ["http://127.0.0.1", ...],
  "ua": ["Mozilla/5.0", ...],
  "search": ["abc", ...],
}'

Optional parameters:

• startTime and endTime – the start and end date in the format Unix Timestamp, for which information will be requested;
• limit – maximum number of display records;
• offset – offset for the display of subsequent records. If the value is 0 and the value is limit 100, records with the sequence number 1-100 will be display, if the value is 1, records with the sequence number 101-200, etc. It is not possible to use the parameter without specifying the maximum number of display records (limit).
• bt – blocking identifier;
• ip – IP address;
• cc – country code;
• vhost – virtual host, domain name;
• method – HTTP request method;
• rule_id – ID of the detected signature;
• signatureType – type of detected signature;
• mz – anomaly detection zone;
• request_id – unique identifier of the request;
• group_id – ID of the request group defined by Nemesida AI MLC as a brute-force or DDoS attack;
• blocked – the status of the actual blocking of the request;
• possible – the filter displays potential attacks, which have not been reliably identified as attacks;
• bodyLimit – the size of the output request body;
• url – search for the occurrence of a string in the URL address;
• args – searching for the entry of a string in the request arguments;
• body – search for the entry of a string in the request body;
• cookie – search for the entry of a string in the header Cookie;
• other_headers – search for the entry of a string in the headers (except Cookie, User-Agent and Referer);
• referer – search for the entry of a string in the Referer header;
• ua – search for the entry of a string in the header User-Agent;
• search – search for the entry of a string for each element from the list among the request zones (url, args, body, cookie, other_headers, referer, ua).

The search for values transmitted as a list is performed according to the principle of logical OR.

Response format:

{
  "status": "success",
  "count": integer,
  "waf_id": string,
  "attacks": [
    {
      "id": integer,
      "timestamp": integer,
      "request_id": string,
      "group_id": string,
      "rule_id": integer,
      "description": string,
      "long_description": string,
      "blocked": boolean,
      "possible": boolean,
      "lm": boolean,
      "mz": array,
      "bt": integer,
      "ip": string,
      "cc": string,
      "vhost": string,
      "method": string,
      "url": string,
      "args":string,
      "body": string,
      "cookie": string,
      "other_headers": string,
      "ua": string,
      "referer": string
    },
    ...
  ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "count": integer,
  "waf_id": string,
  "attacks": [
    {
      "id": 1,
      "timestamp": 173098845,
      "request_id": "b2afdac78f17e017dd2b6dfafcb5a974",
      "group_id": "b2afdac78f17e017dd2b6dfafcb5a974",
      "rule_id": 1,
      "description": "SQLi",
      "long_description": "some_text",
      "blocked": true,
      "possible": false,
      "lm": false,
      "mz": ["args", ...],
      "bt": 2,
      "ip": "1.1.1.1",
      "cc": "RU",
      "vhost": "example.com",
      "method": "POST",
      "url": "/uploads.php",
      "args": "abc",
      "body": "abc",
      "cookie": "abc",
      "other_headers": "abc",
      "ua": "Mozilla/5.0",
      "referer": "http://127.0.0.1"
    },
    ...
  ]
}

id – ID of the database record.

# curl http://api.example.com:8080/nw-api/get_attack_stats --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "startTime": 173098845,
  "endTime": 173096645
}'

Optional parameters:
startTime and endTime – the start and end date in the format Unix Timestamp, for which information will be requested.

Response format:

{
    "status": "success",
    "bt": [
        {
            "bt": integer,
            "period": integer
        },
        ...
    ],
    "ip": [
        {
            "ip": string,
            "period": integer
        },
        ...
    ],
    "cc": [
        {
            "cc": string,
            "period": integer
        },
        ...
    ],
    "vhost": [
        {
            "vhost": string,
            "period": integer
        },
        ...
    ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
    "status": "success",
    "bt": [
        {
            "bt": 1,
            "period": 30
        },
        ...
    ],
    "ip": [
        {
            "ip": "1.1.1.1",
            "period": 45
        },
        ...
    ],
    "cc": [
        {
            "cc": "RU",
            "period": 11
        },
        ...
    ],
    "vhost": [
        {
            "vhost": "example.com",
            "period": 123
        },
        ...
    ]
}

period – the count of events for each bt/cc/vhost/ip for the selected period;
bt – blocking identifier;
ip – IP address;
cc – country code;
vhost – virtual host, domain name.

If the period for which you need to get data is not set by the startTime and endTime parameters, then the information will be output for the last 24 hours, 7 and 30 days.

Response format:

{
  "status": "success",
  "bt": [
    {
      "bt": integer,
      "lastDay": integer,
      "last7Days": integer,
      "last30Days": integer
    },
    ...
  ],
  "ip": [
    {
      "ip": string,
      "lastDay": integer,
      "last7Days": integer,
      "last30Days": integer
    },
    ...
  ],
  "cc": [
    {
      "cc": string,
      ...
      "lastDay": integer,
      "last7Days": integer,
      "last30Days": integer
    },
    ...
  ],
  "vhost": [
    {
      "vhost": string,
      "lastDay": integer,
      "last7Days": integer,
      "last30Days": integer
    },
    ...
  ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "bt": [
    {
      "bt": 1,
      "lastDay": 12,
      "last7Days": 24,
      "last30Days": 145
    },
    ...
  ],
  "ip": [
    {
      "ip": "1.1.1.1",
      "lastDay": 12,
      "last7Days": 24,
      "last30Days": 145
    },
    ...
  ],
  "cc": [
    {
      "cc": "RU",
      ...
      "lastDay": 12,
      "last7Days": 24,
      "last30Days": 145
    },
    ...
  ],
  "vhost": [
    {
      "vhost": "example.com",
      "lastDay": 12,
      "last7Days": 24,
      "last30Days": 145
    },
    ...
  ]
}

lastDay/last7Days/last30Days – the count of events for each bt/cc/vhost/ip for last 24 hour, 7 and 30 days;
bt – blocking identifier;
ip – IP address;
cc – country code;
vhost – virtual host, domain name.

# curl http://api.example.com:8080/nw-api/del_attack --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "id": [1, ...]
}'

Response example:

{"status": "success", "deleted": 15}

or

{"status": "fail", "description": "%description%"}

Required parameters:

• id – ID of the database record.

The search for values transmitted as a list is performed according to the principle of logical OR.

# curl http://api.example.com:8080/nw-api/nws/get_target --header 'Content-type: application/json' --data '{
  "key": "%License key%"
}'

Response format:

{
  "status": "success",
  "targets": [
    {
      "active": boolean,
      "target": string,
      "scan_proxy": string,
      "auth_params": {
        "active": boolean,
        "url": string,
        "username_field": string,
        "username_value": string,
        "password_field": string,
        "password_value": string
      },
      "exclude_modules": [string, ...]
    },
    {
      "active": boolean,
      "target": string
      ...
    }
  ]
}

or

{"status": "fail", "description": "%description%"}

Response example:

{
  "status": "success",
  "targets": [
    {
      "active": true,
      "target": example.com,
      "scan_proxy": "http://proxy.example.com:3128",
      "auth_params": {
        "active": true,
        "url": "http://example.com/login.php",
        "username_field": "username",
        "username_value": "admin",
        "password_field": "password",
        "password_value": "123456"
      },
      "exclude_modules": ["sqli", ...]
    },
    ...
  ]
}

# curl http://api.example.com:8080/nw-api/nws/set_target --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "active": true,
  "target": "http://example.com",
  "scan_proxy": "http://example.com:3128",
  "auth_params": {
    "active": true,
    "url": "/login.php",
    "username_field": "username",
    "username_value": "admin",
    "password_field": "password",
    "password_value": "123456"
  },
  "exclude_modules": [
    "ba", "ca", "lfi", "rce", "rfi", "sde", "sqli", "ssti", "xss"
  ]
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/nws/set_target --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "set": {
    "target": "http://example.com",
    "scan_proxy": null,
    "auth_params": {
      "active": true,
      "url": null,
      "username_field": null,
      "username_value": null,
      "password_field": null,
      "password_value": null
    },
    "exclude_modules": []
  }
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}

# curl http://api.example.com:8080/nw-api/nws/del_target --header 'Content-type: application/json' --data '{
  "key": "%License key%",
  "target": "%Web application address%"
}'

Response example:

{"status": "success"}

or

{"status": "fail", "description": "%description%"}