Events

WAF event log and analysis

Filters

<%= form_with url: events_path, method: :get, local: true, class: "space-y-4" do |form| %>

<%= form.label :ip, "IP Address", class: "block text-sm font-medium text-gray-700" %> <%= form.text_field :ip, value: params[:ip], class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "Filter by IP" %>

<%= form.label :waf_action, "Action", class: "block text-sm font-medium text-gray-700" %> <%= form.select :waf_action, options_for_select([['All', ''], ['Allow', 'allow'], ['Deny', 'deny'], ['Redirect', 'redirect'], ['Challenge', 'challenge']], params[:waf_action]), { }, { class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" } %>

<%= form.label :country, "Country", class: "block text-sm font-medium text-gray-700" %> <%= form.text_field :country, value: params[:country], class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "Country code (e.g. US)" %>

<%= form.submit "Apply Filters", class: "inline-flex justify-center py-2 px-4 border border-transparent shadow-sm text-sm font-medium rounded-md text-white bg-blue-600 hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-blue-500" %> <%= link_to "Clear", events_path, class: "inline-flex justify-center py-2 px-4 border border-gray-300 shadow-sm text-sm font-medium rounded-md text-gray-700 bg-white hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-blue-500" %>

Network Intelligence Filters

<%= form.label :company, "Company", class: "block text-sm font-medium text-gray-700" %> <%= form.text_field :company, value: params[:company], class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "e.g., Amazon, Google" %>

<%= form.label :network_type, "Network Type", class: "block text-sm font-medium text-gray-700" %> <%= form.select :network_type, options_for_select([ ['All', ''], ['Standard ( Residential/Business )', 'standard'], ['Datacenter', 'datacenter'], ['VPN', 'vpn'], ['Proxy', 'proxy'] ], params[:network_type]), { }, { class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" } %>

<%= form.label :asn, "ASN", class: "block text-sm font-medium text-gray-700" %> <%= form.text_field :asn, value: params[:asn], class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "Autonomous System Number" %>

<%= form.label :network_cidr, "Network CIDR", class: "block text-sm font-medium text-gray-700" %> <%= form.text_field :network_cidr, value: params[:network_cidr], class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "e.g., 192.168.1.0/24" %>

<% end %>

Events (<%= number_with_delimiter(@events.count) %>)

<%= link_to "📊 Analytics Dashboard", analytics_path, class: "text-sm text-blue-600 hover:text-blue-800 font-medium" %> <%= link_to "🌐 Network Analytics", analytics_networks_path, class: "text-sm text-blue-600 hover:text-blue-800 font-medium" %> <% if @pagy.pages > 1 %> Page <%= @pagy.page %> of <%= @pagy.pages %> <% end %>

<% if @pagy.pages > 1 %>

<%= pagy_nav_tailwind(@pagy, pagy_id: 'events_top') %>

<% end %>

<% if @events.any? %> <% @events.each do |event| %> <% end %>

Time	IP Address	Action	Path	Method	Status	Country	User Agent
<%= event.timestamp.strftime("%H:%M:%S") %> <%= event.timestamp.strftime("%Y-%m-%d") %>	<% network_range = @network_ranges_by_ip[event.ip_address.to_s] %> <% if network_range %> <%= link_to event.ip_address, network_range_path(network_range), class: "text-blue-600 hover:text-blue-800 hover:underline font-mono" %> <% if network_range.company.present? %> <%= network_range.company %> <% end %> <% if network_range.is_datacenter? \|\| network_range.is_vpn? \|\| network_range.is_proxy? %> <% if network_range.is_datacenter? %> DC <% end %> <% if network_range.is_vpn? %> VPN <% end %> <% if network_range.is_proxy? %> PROXY <% end %> <% end %> <%= network_range.cidr %> <% if network_range.asn.present? %> • ASN <%= network_range.asn %> <% end %> <% else %> <%= event.ip_address %> Unknown network <% end %>	<%= event.waf_action %>	<%= event.request_path \|\| '-' %>	<%= event.request_method ? event.request_method.upcase : '-' %>	<%= event.response_status \|\| '-' %>	<% if event.lookup_country.present? %> <%= event.lookup_country %> <% else %> - <% end %>	<%= event.user_agent&.truncate(50) \|\| '-' %>

<% if @pagy.pages > 1 %> <%= pagy_nav_tailwind(@pagy, pagy_id: 'events_bottom') %> <% end %> <% else %>

No events

<% if params[:ip].present? || params[:waf_action].present? || params[:country].present? %> No events found matching your filters. <% else %> No events have been received yet. <% end %>

<% if params[:ip].present? || params[:waf_action].present? || params[:country].present? %>

<%= link_to "Clear Filters", events_path, class: "inline-flex items-center px-4 py-2 border border-transparent shadow-sm text-sm font-medium rounded-md text-blue-600 bg-blue-100 hover:bg-blue-200 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-blue-500" %>

<% end %>