Skip to main content
HackGATE includes a ModSecurity WAF that inspects all proxied requests in real time. When a request matches a security rule, the event is logged with the rule message, attack category, and timestamp. Use the WAF analytics endpoints to review what researchers are testing and which attack types are most prevalent.
WAF events are separate from traffic analytics — they capture rule violations, not all requests.

​
Attack types detected

HackGATE classifies WAF events into the following attack categories:

​
Authentication and parameters

All WAF endpoints require a Bearer token in the Authorization header. Each endpoint accepts the same query parameters:

​
WAF rule messages

Returns the top 2,500 triggered ModSecurity rule messages ordered by frequency. Use this to identify the most commonly matched rules and the specific payloads researchers are sending.

​
Attack type breakdown

Returns the total event count per attack category for the selected period.
WAF data helps you understand which attack categories researchers are focusing on, so you can prioritize fixes.

​
Attack timeline (12-hour buckets)

Returns the count of WAF events over time, bucketed into 12-hour intervals. Use this to correlate spikes in attack activity with specific testing sessions.

​
Per-site attack type timeline

Returns the attack type breakdown over time, split by site. Useful when you want to compare WAF activity across multiple HackGATE environments.