Website Migration Notice: SafePoint is now operated by CyberServal.Learn more →

View Request and Response Body of all legitmate and malicious Request in log was shipped by syslog?

Published 4 days ago

# SafeLine WAF

Published 4 days ago

Wanki

Updated 4 days ago

After configuring syslog to forward logs to Splunk SIEM, I noticed two issues and have the following questions:

The Request Body and Response Body are not included in the logs, even though they are visible in the UI. Is there any way to include this information in the logs?
SafeLine WAF only logs events that are detected by the WAF. Is there any way to forward logs for all requests sent to the protected domain, including complete Request and Response Body as mentioned in Question 1?

Carrie

Updated 4 days ago

The syslog attack log format does include fields for req_body and rsp_body. You can check the Syslog event format documentation here: https://docs.waf.chaitin.com/en/reference/articles/Syslog
Access logs are located under /data/safeline/logs/nginx/safeline. You'll need to forward them yourself. SafeLine WAF doesn't currently support forwarding access logs natively.
Also, access logs cannot include the full Request Body and Response Body; modifying the log format in the application config won't work either.

Carrie

Updated 4 days ago

Correction: By default, you cannot see the full Request Body and Response Body in the access logs.
The only way to see them is to manually modify the log format in the application configuration — that is, if you add the request body to the log format, it will appear in the access logs.
However, any full re-deployment (such as any change to the application configuration) will overwrite your manual changes back to the default.

Wanki

Updated 4 days ago

In the documentation, I noticed that have 3 fields relative to the body, but 2 field
req_http_body_is_truncate: 0,
rsp_http_body_is_truncate: 0,
It value is onle "0".

And I don't see any field have name "body".