Huawei Cloud WAF Query Skill

Overview

This skill helps users query Huawei Cloud Web Application Firewall (WAF) protection data for daily security inspection and incident troubleshooting:

• Attack events — list attack events by time range, attack type, protection action and domain, and view event details
• Access / protection logs — page through WAF access (event) logs
• Attack statistics — overall counts grouped by attack category (ACCESS / WEB_ATTACK / CC / PRECISE / CRAWLER / BOTM / BLACK_IP / ATTACK)
• Threat overview — threat summary for a recent period (yesterday / today / 3days / 1week / 1month)
• Top attack source IPs — ranking of the most frequent attack source IPs in a time window

All operations are read-only queries (List/Show). No resource is created, modified or deleted.

Prerequisites

1. KooCLI (hcloud) installed and authenticated — see references/cli-installation-guide.md.

2. WAF service permission — the IAM account needs WAF read permissions, see references/iam-policies.md.

3. Project ID — required by most WAF APIs. Obtain it from the Huawei Cloud console (username → My Credentials → Projects) or use:

   hcloud IAM KeystoneListProjects --cli-region=cn-north-4 --name=cn-north-4
   

4. Region — WAF queries must specify a region, e.g. cn-north-4.

5. Time parameters from/to are millisecond timestamps and must be used together; the maximum time range is 30 days.

Workflow

1. Confirm the target time window — compute from/to millisecond timestamps (e.g. last 24 hours). For "today / 3 days" style summaries, ListThreats --recent accepts yesterday|today|3days|1week|1month directly.
2. Get an overview first — run ListStatistics to see the attack distribution, then drill down with ListEvent.
3. List attack events — ListEvent with filters (attack type, action, domain, time range).
4. Inspect a specific event — ShowEvent --eventid=<id> for full detail of a suspicious event.
5. Check logs / rankings — ListEventLog for access logs, ListTopIp for top source IPs, ListThreats for the threat summary.

Core Commands

List attack events

hcloud WAF ListEvent --cli-region=cn-north-4 --project_id={project_id} \
  --from={from_ms} --to={to_ms} [--attacks.1={attack_type}] \
  [--actions.1={action}] [--domains.1={domain}] --pagesize={page_size}

• --attacks.1 values: xss, sqli, rfi, lfi, cmdi, cc, webshell, vuln, botm, robot, antitamper, antileakage, custom_blackip, custom_geoip, illegal, etc.
• --actions.1 values: block, pass, log, captcha, js_challenge, etc.
• --domains.N is the array form for domain filtering (repeatable, e.g. --domains.1=example.com --domains.2=other.com). Do NOT use --domain (singular): it collides with the KooCLI system parameter of the same name and triggers an interactive confirmation, which fails with [USE_ERROR]EOF in non-interactive (Agent) execution.
• pagesize cannot be -1; at most 10,000 records can be queried.

Show attack event detail

hcloud WAF ShowEvent --cli-region=cn-north-4 --project_id={project_id} --eventid={event_id}

List access / protection logs

hcloud WAF ListEventLog --cli-region=cn-north-4 --project_id={project_id} --page={page} --pagesize={size}

Attack statistics overview

hcloud WAF ListStatistics --cli-region=cn-north-4 --project_id={project_id} --from={from_ms} --to={to_ms}

Threat overview (recent period)

hcloud WAF ListThreats --cli-region=cn-north-4 --project_id={project_id} --from={from_ms} --to={to_ms} --recent={yesterday|today|3days|1week|1month}

Top attack source IPs

hcloud WAF ListTopIp --cli-region=cn-north-4 --project_id={project_id} --from={from_ms} --to={to_ms}

Parameter Confirmation

KooCLI Command Format Standard

hcloud <Service> <Operation> --cli-region=<region> [--key=value ...]

• Service name: WAF
• Operation name: PascalCase, e.g. ListEvent, ShowEvent, ListStatistics
• Region parameter: --cli-region=<value> (e.g. cn-north-4)
• Simple parameter: --key=value (e.g. --eventid=xxx)
• Indexed array parameter: --key.N=value (e.g. --attacks.1=sqli)

Reference Documents

• references/cli-installation-guide.md — KooCLI installation and authentication
• references/iam-policies.md — Least-privilege IAM policies for WAF read-only access
• references/verification-method.md — How to verify the skill works
• references/dataflow-diagram.md — Mermaid data flow diagram
• references/acceptance-criteria.md — Acceptance criteria for this skill
• references/related-commands.md — Command quick reference

Edge Cases