huawei-cloud-waf-log-analysis
Installation
SKILL.md
Huawei Cloud WAF Security Event Log Analysis
Overview
This skill provides read-only analysis of Huawei Cloud WAF (Web Application Firewall) security event logs. It queries attack event data through hcloud CLI, performs multi-dimensional aggregation and analysis, and generates actionable protection rule recommendations based on observed attack patterns.
Key Capabilities:
- Query and filter security events by attack type, source IP, target domain/URL, time range, and geography
- Aggregate statistics by attack category, source IP frequency, geographic distribution, and time trends
- Recommend specific WAF protection rules (precise access control, CC protection, IP blacklist/whitelist, geo-blocking) based on analyzed attack characteristics
Applicable Scenarios:
- Daily security patrol and attack posture review
- Incident response after receiving WAF alerts
- Periodic security reports (weekly/monthly attack trends)
- Anomaly investigation when suspicious activity is detected
- Protection hardening decisions after attack events