Using the Reblaze Query Box

How to filter results

Introduction

The Reblaze query command box allows you to query the data in order to present only the records that you want. The structure of a filter is operator:value.

Using the query/filter box to search for blocked XSS attempts

For example, to view only traffic from IP 10.11.12.13:

ip:10.11.12.13

An exclamation mark ("!") can be used with various filters as a "NOT" operator. So, to exclude requests from an IP, add "!" as a prefix:

ip:!10.11.12.13

Note that filters can be combined to fine-tune a search, by chaining them with a comma. For example, in order to show all traffic from France that was blocked:

country:France, is:blocked

Building Queries Efficiently

The fastest way to build query strings is to double-click on labels of existing log entries. This will add the value of each label as a filter to the query box. When you have constructed the entire query string, click on the search button, or place the cursor into the text field and hit "Return" on your keyboard.

For example, when looking at this entry for a blocked request (the IPs have been censored for privacy reasons):

Let's say you wanted to quickly see what other requests produced a 403 error that came in from the United States on a cloud IP. Double-clicking on the "403" label, the "United States" label, and the "Cloud" label builds the query string for you automatically:

Automatically adding filter parameters to the query box

Then select the "search" button, or place the cursor within the query box and hit "Return" on your keyboard, to process the query.

In some situations, this technique has limited usefulness. In the example screenshot above, double-clicking on the label beginning with "XSS" would add a (very) long filter string to the query, because that label contains the full script from the injection attempt (although the label itself only displays the first few characters in the interface).

If this is what you want (perhaps you need to search only for logged requests which contain that exact script), then this is effective. But if you wanted to build a more general query, then this is not useful.

A better approach is to choose a representative substring.

Queries can be based on substrings. Internally, Reblaze executes a "contains" search, so queries will return everything that contains the string that was specified.

In some situations, you'll want to build queries that produce exact matches. But in many other situations, it's faster just to search for a relevant substring instead.

Examples:

• reason:XSS will show all records with "XSS" in their reason label.

• url:login will include all URLs that include "login".

• ip:191 will display all IP addresses containing "191".

Filter Use Cases and Examples

Regular expressions can be applied to the filter value to make the search more accurate. The regex matching is done by wrapping the search value with re(REGEX here). Examples:

is:re(200|401)

ua:re(iOS!iPhone!iPad)

If you wish to display login requests with method “POST” which were blocked, but not by the origin (upstream server):

url:/login,is:POST,is:blocked,is:!origin.

This displays those requests which produced 502-504 error codes:

is:re(502|504)

This displays the requests that contain a specific value in an argument:

arg_name:text, arg_value:free_text

Available filters

Name	Explanation
After	Log records registered after a given date and time.
Before	Log records registered before a given date and time.
arg_name	Search for an argument by name
arg_value	Search for an argument value
asn	Autonomous System Number for the IP
city	Abbreviation for the country. Example: "US" for the United States.
country	Name of the country
cookie_rbzid	Reblaze ID cookie value (base64)
cookie_name	Search by cookie name
cookie_value	Search by cookie value
domain_name	The main domain name in Reblaze (not necessarily the actual Host header).
ext	File extension
header_name	Name of header
header_value	Value found in header_name
host	HTTP Host header: usually, the domain name of the application.
id	Reblaze unique request ID.
ip	IP address of the web client.
is	IS is a special operator that can be used for almost all attributes of a request. It can be used to filter a certain HTTP method, "flags" and protocol version. For instance, to get blocked POST requests made by a human, type: is:blocked, is:human, is:post.
mime	Multipurpose Internet Mail Extensions
origin	The IP address of the origin server.
path	The path of the request (the URL without the query string part).
proxy	The IP address of the particular Reblazer server.
rbzid	Hash value of Reblaze ID cookie value (md5).
reason	Reason the request was blocked or passed.
ref	HTTP referer header.
sslcipher	The chosen SSL cipher.
sslprotocol	The chosen SSL protocol.
status	Response status code (regex is acceptable, e.g. [45]\d\d).
ua	HTTP User Agent header.
upstream_status	Response status code from upstream servers (regex is acceptable, e.g. [45]\d\d).
url	A substring to search for within the complete URL request line (including the query string).