Webmonitorx

https://docs.webmonitorx.ru
Admin
Webmonitorx is an application security platform and WAF that protects web applications, APIs, and...
Tokens:226,782
Snippets:1,997
Trust Score:7.8
Update:1 month ago
Show doc for...
Tokens:
Raw
### Let's Encrypt Certificate Installation

Source: https://docs.webmonitorx.ru/pro-api/settings/installation-docker

Commands to install Nginx, Certbot, and generate SSL certificates.

```bash
apt update
apt install -y nginx certbot python3-certbot-nginx
certbot --nginx -d example.ru -d www.example.ru -d manager.example.ru
```

--------------------------------

### Example NGINX configuration with Webmonitorx

Source: https://docs.webmonitorx.ru/installation/nginx/dynamic-module

Example server block configuration showing the wallarm_mode directive.

```nginx
server {
    # порт, для которого фильтруется трафик
    listen       80;
    # домен, для которого фильтруется трафик
    server_name  localhost;
    # режим работы ноды Вебмониторэкс
    wallarm_mode monitoring;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
}
```

--------------------------------

### Example NGINX Configuration File

Source: https://docs.webmonitorx.ru/installation/cloud-platforms/yandex-cloud/docker-container

A minimal NGINX configuration file template for the Webmonitorx node.

```nginx
server {
    listen 80 default_server;
    listen [::]:80 default_server ipv6only=on;
    #listen 443 ssl;

    server_name localhost;

    #ssl_certificate cert.pem;
    #ssl_certificate_key cert.key;

    root /usr/share/nginx/html;

    index index.html index.htm;

    wallarm_mode monitoring;
    # wallarm_application 1;

    location / {
            proxy_pass http://example.com;
            include proxy_params;
    }
}
```

--------------------------------

### Fluentd Configuration Example

Source: https://docs.webmonitorx.ru/user-guides/settings/integrations/fluentd

Basic configuration for Fluentd to accept HTTPS traffic and output logs to stdout.

```text
<source>
  @type http # input‑плагин для HTTP и HTTPS‑трафика
  port 9880 # порт для входящих запросов
  <transport tls> # настройки для обработки подключений к Fluentd
    cert_path /etc/ssl/certs/fluentd.crt
    private_key_path /etc/ssl/private/fluentd.key
  </transport>
</source>
<match **>
  @type copy
  <store>
     @type stdout # output‑плагин для вывода логов Fluentd в командную строку
     output_type json # формат вывода логов Fluentd в командную строку
  </store>
</match>
```

--------------------------------

### Configure post-analytics upstream

Source: https://docs.webmonitorx.ru/installation/nginx/dynamic-module

Example configuration for defining the post-analytics server upstream in wallarm.conf.

```nginx
upstream wallarm_tarantool {
    server <ip1>:3313 max_fails=0 fail_timeout=0 max_conns=1;
    server <ip2>:3313 max_fails=0 fail_timeout=0 max_conns=1;

    keepalive 2;
    }

    # omitted

wallarm_tarantool_upstream wallarm_tarantool;
```

--------------------------------

### Fluentd Log Entry Example

Source: https://docs.webmonitorx.ru/user-guides/settings/integrations/fluentd

Sample JSON structure of a test notification received in Fluentd logs.

```json
[
    {
        summary:"[Тестовое сообщение] [Вебмониторэкс] Обнаружена новая уязвимость",
        description:"Тип события: vuln

                    В вашей системе обнаружена новая уязвимость.

                    ID: 
                    Название: Test
                    Домен: example.com
                    Путь: 
                    Метод: 
                    Источник: 
                    Параметры: 
                    Тип: Info
                    Уровень риска: Medium

                    Подробнее: https://my.webmonitorx.ru/object/555


                    Клиент: TestCompany
                    Вычислительный кластер: RU
                    ",
        details:{
            client_name:"TestCompany",
            cloud:"RU",
            notification_type:"vuln",
            vuln_link:"https://my.webmonitorx.ru/object/555",
            vuln:{
                domain:"example.com",
                id:null,
                method:null,
                parameter:null,
                path:null,
                title:"Test",
                discovered_by:null,
                threat:"Medium",
                type:"Info"
            }
        }
    }
]
```

--------------------------------

### Configure Tenant Applications

Source: https://docs.webmonitorx.ru/installation/multi-tenant/deploy-multi-tenant-node

Example of using the wallarm_application directive to identify specific applications within a tenant's traffic.

```nginx
server {
    listen       80;
    server_name  tenant1.com;
    wallarm_mode block;
    wallarm_partner_client_uuid 11111111-1111-1111-1111-111111111111;

    location / {
        proxy_pass      http://upstream1:8080;
    }

    location /login {
        wallarm_application 21;
        ...
    }
    location /users {
        wallarm_application 22;
        ...
    }
}
```

--------------------------------

### GraphQL Query Metric Examples

Source: https://docs.webmonitorx.ru/api-protection/limit-compliance

Various queries demonstrating how NodeCount, Complexity, and Depth are calculated based on the provided schema.

```graphql
query {
  users(first: 10) {
    name
    messages(first:100) {
      id
      text
    }
  }
}
```

```graphql
query {
  users(first: 10) {
    name
  }
}
```

```graphql
query {
  message(id:1) {
    id
    text
  }
}
```

```graphql
query {
  users(first: 10) {
    name
    messages(first:1) {
      id
      text
    }
  }
}
```

--------------------------------

### JWT Authentication Header Example

Source: https://docs.webmonitorx.ru/user-guides/rules/request-processing

Example of a JWT token passed within an Authentication header.

```text
Authentication: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```

--------------------------------

### Запуск инициализации данных через Docker

Source: https://docs.webmonitorx.ru/pro-api/settings/installation-docker

Команды для запуска контейнера seeder в зависимости от сетевого окружения PostgreSQL.

```bash
  docker run --rm \
  -e WMX_PG_HOST=host.docker.internal \
  -e WMX_PG_PORT=5433\
  -e WMX_PG_USER=apifw \
  -e WMX_PG_PASSWORD=12345\
  -e WMX_PG_DB_NAME=api_fw_manager \
  -e WMX_USER_EMAIL=admin@example.com \
  -e WMX_USER_PASSWORD='ChangeMe123!'\
  -e WMX_USER_NAME='Bootstrap Admin'\
  -e WMX_USER_COMPANY='Default Company'\
  registry.webmonitorx.ru/api-firewall/seeder:<tag>
```

```bash
  docker run --rm \
  --network api-fw-manager-v2 \
  -e WMX_PG_HOST=pg \
  -e WMX_PG_PORT=5432 \
  -e WMX_PG_USER=discovery \
  -e WMX_PG_PASSWORD=12345 \
  -e WMX_PG_DB_NAME=discovery \
  -e WMX_PG_CONNECTION_EXTRAS='sslmode=disable' \
  -e WMX_USER_EMAIL='admin@example.com' \
  -e WMX_USER_PASSWORD='ChangeMe123!' \
  -e WMX_USER_NAME='Bootstrap Admin' \
  -e WMX_USER_COMPANY='Default Company' \
  registry.webmonitorx.ru/api-firewall/seeder:2.0.3
```

--------------------------------

### GET /v2/partner_client

Source: https://docs.webmonitorx.ru/updating-migrating/older-versions/multi-tenant

Retrieves a list of clients associated with a partner to obtain their client IDs.

```APIDOC
## GET /v2/partner_client

### Description
Retrieves the list of clients associated with a specific partner ID.

### Method
GET

### Endpoint
https://api.webmonitorx.ru/v2/partner_client

### Parameters
#### Query Parameters
- **partnerid** (string) - Required - The identifier of the partner.

### Request Example
curl -X GET 'https://api.webmonitorx.ru/v2/partner_client?partnerid=PARTNER_ID' -H 'accept: application/json' -H 'x-wallarmapi-secret: YOUR_SECRET_KEY' -H 'x-wallarmapi-uuid: YOUR_UUID'

### Response
#### Success Response (200)
- **body** (array) - List of client objects containing id, partnerid, and clientid.
```

--------------------------------

### Установка NGINX stable на Ubuntu

Source: https://docs.webmonitorx.ru/installation/meganode

Команды для добавления репозитория NGINX и установки пакета на Ubuntu.

```bash
sudo apt install curl gnupg2 ca-certificates lsb-release
echo "deb http://nginx.org/packages/ubuntu `lsb_release -cs` nginx" | sudo tee /etc/apt/sources.list.d/nginx.list
curl -fsSL https://nginx.org/keys/nginx_signing.key | sudo apt-key add -
sudo apt update
sudo apt install nginx
```

--------------------------------

### Пример конфигурации NGINX для Вебмониторэкс

Source: https://docs.webmonitorx.ru/admin-ru/installation-gcp-ru

Конфигурация сервера для обработки HTTP-трафика доменов example.com и www.example.com в режиме мониторинга с проксированием на внутренний сервер.

```nginx
    server {
      listen 80;
      listen [::]:80 ipv6only=on;

      # the domains for which traffic is processed
      server_name example.com; 
      server_name www.example.com;

      # turn on the monitoring mode of traffic processing
      wallarm_mode monitoring; 

      location / {
        # setting the address for request forwarding
        proxy_pass http://10.80.0.5; 
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      }
    }
```

--------------------------------

### Introspection Query Example

Source: https://docs.webmonitorx.ru/api-protection/limit-compliance

An introspection query that returns 0 for metrics due to the @nodeCountSkip directive.

```graphql
query IntrospectionQuery {
  __schema {
    queryType {
      name
    }
    mutationType {
      name
    }
    subscriptionType {
      name
    }
    types {
      ...FullType
    }
    directives {
      name
      description
      locations
      args {
        ...InputValue
      }
    }
  }
}

fragment FullType on __Type {
  kind
  name
  description
  fields(includeDeprecated: true) {
    name
    description
    args {
      ...InputValue
    }
    type {
      ...TypeRef
    }
    isDeprecated
    deprecationReason
  }
  inputFields {
    ...InputValue
  }
  interfaces {
    ...TypeRef
  }
  enumValues(includeDeprecated: true) {
    name
    description
    isDeprecated
    deprecationReason
  }
  possibleTypes {
    ...TypeRef
  }
}

fragment InputValue on __InputValue {
  name
  description
  type {
    ...TypeRef
  }
  defaultValue
}

fragment TypeRef on __Type {
  kind
  name
  ofType {
    kind
    name
    ofType {
      kind
      name
      ofType {
        kind
        name
        ofType {
          kind
          name
          ofType {
            kind
            name
            ofType {
              kind
              name
              ofType {
                kind
                name
              }
            }
          }
        }
      }
    }
  }
}
```

--------------------------------

### Открытие конфигурационного файла для редактирования

Source: https://docs.webmonitorx.ru/admin-ru/monitoring/meganode-zabbix

Команды для открытия конфигурации NGINX или Angie в редакторе vim.

```bash
sudo vim /etc/nginx/conf.d/default.conf
```

```bash
sudo vim /etc/angie/conf.d/default.conf
```

--------------------------------

### GraphQL Depth Calculation Example

Source: https://docs.webmonitorx.ru/api-protection/limit-compliance

A simple query structure demonstrating a nesting depth of 3.

```graphql
{
    a {
        b {
            c
        }
    }
}
```

--------------------------------

### Удаление пакетных версий ноды в Ubuntu/Debian

Source: https://docs.webmonitorx.ru/updating-migrating/update-to-meganode

Команды для удаления пакетов из репозиториев webmonitorx и wallarm, исключая libbrotli1.

```bash
sudo apt-get purge `grep -ohP "^Package: \K.*" /var/lib/apt/lists/repo.webmonitorx* | grep -v libbrotli1`
sudo apt-get purge `grep -ohP "^Package: \K.*" /var/lib/apt/lists/repo.wallarm* | grep -v libbrotli1`
```

--------------------------------

### Webhook Notification JSON for Detected Vulnerabilities

Source: https://docs.webmonitorx.ru/user-guides/settings/integrations/webhook

Example payload structure for a new vulnerability event notification.

```json
[
    {
        summary:"[Вебмониторэкс] Обнаружена новая уязвимость",
        description:"Тип события: vuln

                    В вашей системе обнаружена новая уязвимость.

                    ID: 
                    Название: Test
                    Домен: example.com
                    Путь: 
                    Метод: 
                    Источник: 
                    Параметры: 
                    Тип: Info
                    Уровень риска: Medium

                    Подробнее: https://my.webmonitorx.ru/object/555


                    Клиент: TestCompany
                    Вычислительный кластер: RU
                    ",
        details:{
            client_name:"TestCompany",
            cloud:"RU",
            notification_type:"vuln",
            vuln_link:"https://my.webmonitorx.ru/object/555",
            vuln:{
                domain:"example.com",
                id:null,
                method:null,
                parameter:null,
                path:null,
                title:"Test",
                discovered_by:null,
                threat:"Medium",
                type:"Info"
            }
        }
    }
]
```

--------------------------------

### Проверка статуса SELinux

Source: https://docs.webmonitorx.ru/admin-ru/configure-selinux

Команда для определения текущего состояния SELinux в системе.

```bash
sestatus
```

--------------------------------

### Обновление пакетов в Debian/Ubuntu

Source: https://docs.webmonitorx.ru/updating-migrating/older-versions/separate-postanalytics

Используйте эти команды для обновления списка пакетов и выполнения дистрибутивного обновления в системах Debian и Ubuntu.

```bash
sudo apt update
sudo apt dist-upgrade
```

--------------------------------

### External Nginx Configuration

Source: https://docs.webmonitorx.ru/pro-api/settings/installation-docker

Example Nginx server block configuration for handling traffic to the manager and node.

```nginx
server {
    listen 80;
    server_name example.ru www.example.ru manager.example.ru;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.ru www.example.ru;

    ssl_certificate /etc/letsencrypt/live/example.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.ru/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8090;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}


server {
    listen 443 ssl http2;
    server_name manager.example.ru;

    ssl_certificate /etc/letsencrypt/live/example.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.ru/privkey.pem;

    location /api/ {
        proxy_pass http://127.0.0.1:7777;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }

    location / {
        proxy_pass http://127.0.0.1:3001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}
```

--------------------------------

### Файл docker-compose.yaml

Source: https://docs.webmonitorx.ru/admin-ru/monitoring/network-plugin-influxdb

Конфигурация для запуска контейнеров InfluxDB и Grafana.

```yaml
version: "3"

services:
  influxdb:
    image: influxdb
    container_name: influxdb
    ports:
      - 8086:8086
      - 25826:25826/udp
    networks:
      - sample-net
    volumes:
      - ./:/var/lib/influxdb
      - ./influxdb.conf:/etc/influxdb/influxdb.conf:ro
      - ./types.db:/usr/share/collectd/types.db:ro

  grafana:
    image: grafana/grafana
    container_name: grafana
    restart: always
    ports:
      - 3000:3000
    networks:
      - sample-net

networks:
  sample-net:
```

--------------------------------

### Example notification in Sumo Logic

Source: https://docs.webmonitorx.ru/user-guides/settings/integrations/sumologic

A sample JSON payload representing a test notification sent to Sumo Logic.

```json
{
    summary:"[Тестовое сообщение] [Вебмониторэкс] Обнаружена новая уязвимость",
    description:"Тип события: vuln

                В вашей системе обнаружена новая уязвимость.

                ID: 
                Название: Test
                Домен: example.com
                Путь: 
                Метод: 
                Источник: 
                Параметры: 
                Тип: Info
                Уровень риска: Medium

                Подробнее: https://my.webmonitorx.ru/object/555


                Клиент: TestCompany
                Облако: RU
                ",
    details:{
        client_name:"TestCompany",
        cloud:"RU",
        notification_type:"vuln",
        vuln_link:"https://my.webmonitorx.ru/object/555",
        vuln:{
            domain:"example.com",
            id:null,
            method:null,
            parameter:null,
            path:null,
            title:"Test",
            discovered_by:null,
            threat:"Medium",
            type:"Info"
        }
    }
}
```

--------------------------------

### Create Compute Instance with Docker Container

Source: https://docs.webmonitorx.ru/installation/cloud-platforms/yandex-cloud/docker-container

Deploy the Webmonitorx node container using the Yandex Cloud CLI with specified environment variables for configuration.

```bash
yc compute instance create-with-container \
    --name <INSTANCE_NAME> \
    --zone=<DEPLOYMENT_ZONE> \
    --public-ip \
    --container-image=registry.webmonitorx.ru/public/meganode:4.10.0-1 \
    --container-env=WALLARM_API_TOKEN=${WALLARM_API_TOKEN},NGINX_BACKEND=<HOST_TO_PROTECT_WITH_WALLARM>,WALLARM_API_HOST=api.webmonitorx.ru
```

--------------------------------

### Example Mattermost notification message

Source: https://docs.webmonitorx.ru/user-guides/settings/integrations/mattermost

Displays the format of a test notification received in Mattermost when the integration is configured correctly.

```text
[Тестовое сообщение] [Вебмониторэкс] Сетевой периметр изменен

Тип события: new_scope_object_ips

В сетевом периметре обнаружены IP-адреса:
8.8.8.8

Клиент: TestCompany
Вычислительный кластер: RU

```

--------------------------------

### SSI Injection Example

Source: https://docs.webmonitorx.ru/attacks-vulns-list

Demonstrates a malicious SSI directive used to manipulate error messages returned by the server.

```html
<!--#config errmsg="Access denied, please enter your username and password"-->
```

--------------------------------

### Directory Structure

Source: https://docs.webmonitorx.ru/pro-api/settings/installation-docker

Recommended base directory paths for the manager and node components.

```text
/opt/proapi/manager
/opt/proapi/node
```

--------------------------------

### Установка NGINX stable

Source: https://docs.webmonitorx.ru/installation/nginx/dynamic-module

Команды для установки NGINX из официального репозитория на Ubuntu и RHEL.

```bash
sudo apt -y update && \
sudo apt install -y curl gnupg2 ca-certificates lsb-release ubuntu-keyring && \
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
        | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/ubuntu `lsb_release -cs` nginx" \
        | sudo tee /etc/apt/sources.list.d/nginx.list && \
echo -e "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n" \
        | sudo tee /etc/apt/preferences.d/99nginx && \
sudo apt -y update && \
sudo apt install nginx
```

```bash
sudo yum install yum-utils && \
echo -e "[nginx-stable]\nname=nginx stable repo\nbaseurl=http://nginx.org/packages/centos/\$releasever/\$basearch/\ngpgcheck=1\nenabled=1\ngpgkey=https://nginx.org/keys/nginx_signing.key\nmodule_hotfixes=true" | sudo tee /etc/yum.repos.d/nginx.repo && \
sudo yum install nginx
```

--------------------------------

### View GPG Signature Errors

Source: https://docs.webmonitorx.ru/faq/common-errors-after-installation

Example output of GPG signature verification failures during package manager updates.

```text
https://repo.webmonitorx.ru/centos/wallarm-node/7/2.18/x86_64/repodata/repomd.xml:
[Errno -1] repomd.xml signature could not be verified for wallarm-node_3.6

One of the configured repositories failed (Вебмониторэкс Node for CentOS 7 - 3.6),
and yum doesn't have enough cached data to continue.

W: GPG error: http://repo.webmonitorx.ru/ubuntu/wallarm-node focal/4.0/ Release: The following signatures
couldn't be verified because the public key is not available: NO_PUBKEY 1111FQQW999
E: The repository 'http://repo.webmonitorx.ru/ubuntu/wallarm-node focal/4.0/ Release' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
```

--------------------------------

### Batch Query Limit Enforcement

Source: https://docs.webmonitorx.ru/api-protection/limit-compliance

Example of a batch request exceeding the configured limit and the resulting error message.

```json
[
  {"query":"query {\n  systemHealth\n}","variables":[]},
  {"query":"query {\n  systemHealth\n}","variables":[]},
  {"query":"query {\n  systemHealth\n}","variables":[]}
]
```

```text
ERROR GraphQL query validation error=the batch query limit has been exceeded. The number of queries in the batch is 3. The current batch query limit is 2 protocol=HTTP
```
Tokens:
Raw