"list"
******

* Description

* Usage

* Required Parameters

* Optional Parameters

* Global Parameters

* Example using required parameter


Description
===========

Gets structured Web Application Firewall event logs for a WAAS policy.
Sorted by the *timeObserved* in ascending order (starting from the
oldest recorded event).


Usage
=====

   oci waas waf-log list [OPTIONS]


Required Parameters
===================

--waas-policy-id [text]

The OCID of the WAAS policy.


Optional Parameters
===================

--access-rule-key [text]

Filters logs by access rule key.

--action [text]

Filters logs by Web Application Firewall action.

Accepted values are:

   BLOCK, BYPASS, DETECT, LOG, REDIRECTED

--all

Fetches all pages of results. If you provide this option, then you
cannot provide the "--limit" option.

--client-address [text]

Filters logs by client IP address.

--country-code [text]

Filters logs by country code. Country codes are in ISO 3166-1 alpha-2
format. For a list of codes, see ISO’s website.

--country-name [text]

Filter logs by country name.

--fingerprint [text]

Filter logs by device fingerprint.

--from-json [text]

Provide input to this command as a JSON document from a file using the
file://path-to/file syntax.

The "--generate-full-command-json-input" option can be used to
generate a sample json file to be used with this command option. The
key names are pre-populated and match the command option names
(converted to camelCase format, e.g. compartment-id –> compartmentId),
while the values of the keys need to be populated by the user before
using the sample file as an input to this command. For any command
option that accepts multiple values, the value of the key can be a
JSON array.

Options can still be provided on the command line. If an option exists
in both the JSON document and the command line then the command line
specified value will be used.

For examples on usage of this option, please see our “using CLI with
advanced JSON options” link: https://docs.cloud.oracle.com/iaas/Conte
nt/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--http-method [text]

Filter logs by HTTP method.

Accepted values are:

   CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, TRACE

--incident-key [text]

Filter logs by incident key.

--limit [integer]

The maximum number of items to return in a paginated call. If
unspecified, defaults to *20*.

--log-type [text]

Filter by log type. For more information about WAF logs, see Logs.

Accepted values are:

   ACCESS, ACCESS_RULES, ADDRESS_RATE_LIMITING, CAPTCHA, DEVICE_FINGERPRINT_CHALLENGE, HUMAN_INTERACTION_CHALLENGE, JS_CHALLENGE, PROTECTION_RULES, THREAT_FEEDS

--origin-address [text]

Filter by origin IP address.

--page [text]

The value of the *opc-next-page* response header from the previous
paginated call.

--page-size [integer]

When fetching results, the number of results to fetch per call. Only
valid when used with "--all" or "--limit", and ignored otherwise.

--protection-rule-key [text]

Filter by protection rule key.

--referrer [text]

Filter by referrer.

--request-url [text]

Filter by request URL.

--response-code [text]

Filter by response code.

--text-contains [text]

A full text search for logs.

--threat-feed-key [text]

Filter by threat feed key.

--time-observed-greater-than-or-equal-to [datetime]

A filter that matches log entries where the observed event occurred on
or after a date and time specified in RFC 3339 format. If unspecified,
defaults to two hours before receipt of the request.

   The following datetime formats are supported:


UTC with microseconds
---------------------

   Format: YYYY-MM-DDTHH:mm:ss.ssssssTZD
   Example: 2017-09-15T20:30:00.123456Z

   UTC with milliseconds
   ***********************
   .. code::

       Format: YYYY-MM-DDTHH:mm:ss.sssTZD
       Example: 2017-09-15T20:30:00.123Z

   UTC without milliseconds
   **************************
   .. code::

       Format: YYYY-MM-DDTHH:mm:ssTZD
       Example: 2017-09-15T20:30:00Z

   UTC with minute precision
   **************************
   .. code::

       Format: YYYY-MM-DDTHH:mmTZD
       Example: 2017-09-15T20:30Z


Timezone with microseconds
--------------------------

   Format: YYYY-MM-DDTHH:mm:ssTZD
   Example: 2017-09-15T12:30:00.456789-08:00, 2017-09-15T12:30:00.456789-0800

   Timezone with milliseconds
   ***************************
   .. code::

       Format: YYYY-MM-DDTHH:mm:ssTZD
       Example: 2017-09-15T12:30:00.456-08:00, 2017-09-15T12:30:00.456-0800

   Timezone without milliseconds
   *******************************
   .. code::

       Format: YYYY-MM-DDTHH:mm:ssTZD
       Example: 2017-09-15T12:30:00-08:00, 2017-09-15T12:30:00-0800

   Timezone with minute precision
   *******************************
   .. code::

       Format: YYYY-MM-DDTHH:mmTZD
       Example: 2017-09-15T12:30-08:00, 2017-09-15T12:30-0800

   Short date and time
   ********************
   The timezone for this date and time will be taken as UTC (Needs to be surrounded by single or double quotes)

   .. code::

       Format: 'YYYY-MM-DD HH:mm' or "YYYY-MM-DD HH:mm"
       Example: '2017-09-15 17:25'

   Date Only
   **********
   This date will be taken as midnight UTC of that day

   .. code::

       Format: YYYY-MM-DD
       Example: 2017-09-15

   Epoch seconds
   **************
   .. code::

       Example: 1412195400

--time-observed-less-than [datetime]

A filter that matches log entries where the observed event occurred
before a date and time, specified in RFC 3339 format.

   The following datetime formats are supported:


UTC with microseconds
---------------------

   Format: YYYY-MM-DDTHH:mm:ss.ssssssTZD
   Example: 2017-09-15T20:30:00.123456Z

   UTC with milliseconds
   ***********************
   .. code::

       Format: YYYY-MM-DDTHH:mm:ss.sssTZD
       Example: 2017-09-15T20:30:00.123Z

   UTC without milliseconds
   **************************
   .. code::

       Format: YYYY-MM-DDTHH:mm:ssTZD
       Example: 2017-09-15T20:30:00Z

   UTC with minute precision
   **************************
   .. code::

       Format: YYYY-MM-DDTHH:mmTZD
       Example: 2017-09-15T20:30Z


Timezone with microseconds
--------------------------

   Format: YYYY-MM-DDTHH:mm:ssTZD
   Example: 2017-09-15T12:30:00.456789-08:00, 2017-09-15T12:30:00.456789-0800

   Timezone with milliseconds
   ***************************
   .. code::

       Format: YYYY-MM-DDTHH:mm:ssTZD
       Example: 2017-09-15T12:30:00.456-08:00, 2017-09-15T12:30:00.456-0800

   Timezone without milliseconds
   *******************************
   .. code::

       Format: YYYY-MM-DDTHH:mm:ssTZD
       Example: 2017-09-15T12:30:00-08:00, 2017-09-15T12:30:00-0800

   Timezone with minute precision
   *******************************
   .. code::

       Format: YYYY-MM-DDTHH:mmTZD
       Example: 2017-09-15T12:30-08:00, 2017-09-15T12:30-0800

   Short date and time
   ********************
   The timezone for this date and time will be taken as UTC (Needs to be surrounded by single or double quotes)

   .. code::

       Format: 'YYYY-MM-DD HH:mm' or "YYYY-MM-DD HH:mm"
       Example: '2017-09-15 17:25'

   Date Only
   **********
   This date will be taken as midnight UTC of that day

   .. code::

       Format: YYYY-MM-DD
       Example: 2017-09-15

   Epoch seconds
   **************
   .. code::

       Example: 1412195400

--user-agent [text]

Filter by user agent.


Global Parameters
=================

Use "oci --help" for help on global parameters.

"--auth-purpose", "--auth", "--cert-bundle", "--cli-auto-prompt", "--
cli-rc-file", "--config-file", "--connection-timeout", "--debug", "--
defaults-file", "--endpoint", "--generate-full-command-json-input", "
--generate-param-json-input", "--help", "--latest-version", "--max-
retries", "--no-retry", "--opc-client-request-id", "--opc-request-id",
"--output", "--profile", "--proxy", "--query", "--raw-output", "--
read-timeout", "--realm-specific-endpoint", "--region", "--release-
info", "--request-id", "--version", "-?", "-d", "-h", "-i", "-v"


Example using required parameter
================================

Copy the following CLI commands into a file named example.sh. Run the
command by typing “bash example.sh” and replacing the example
parameters with your own.

Please note this sample will only work in the POSIX-compliant bash-
like shell. You need to set up the OCI configuration and appropriate
security policies before trying the examples.

       export compartment_id=<substitute-value-of-compartment_id> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/waas/waas-policy/create.html#cmdoption-compartment-id
       export domain=<substitute-value-of-domain> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/waas/waas-policy/create.html#cmdoption-domain

       waas_policy_id=$(oci waas waas-policy create --compartment-id $compartment_id --domain $domain --query data.id --raw-output)

       oci waas waf-log list --waas-policy-id $waas_policy_id
