将cloudflare waf日志推送到S3,同步到阿里云SLS，从日志中过滤高风险ip，将访问量大的风险ip开启5秒盾或者JS challenge选项

    1. #!/bin/bash
    2. #sync gt 400 EdgeResponseStatus
    4. log_dir=`date +%Y-%m-%d`
    5. log_time="`date "+%Y-%m-%d %H:%M:%S"`"
    6. lastweek_time="`date -d -2day "+%Y-%m-%d %H:%M:%S"`"
    7. log_status_dir="/data/drop/${log_dir}"
    9. #cf user
    10. CFEMAIL="bob.huo@orderplus.com"
    11. CFAPIKEY="f6f44711479c2***984df57959ed3060a8f3"
    12. ZONESID="4fafc4f93dd3b3***385388072a2708"
    14. #check folder
    15. check_folder(){
    16.     [[ ! -e "${log_status_dir}" ]] && mkdir -p $log_status_dir
    17.     }
    18. check_folder
    20. #pull log
    21. /usr/local/bin/aliyunlog log get_log_all --project="cloudflare-logs" --logstore="log-cf" --query='*|select ClientIP,ip_to_country(ClientIP) as country, ip_to_provider(ClientIP) as provider, count(1) as PV wh
    22. ere security_check_ip(ClientIP) = 1 group by ClientIP order by PV desc' --from_time="${lastweek_time}+08:00" \
    23.         --to_time="${log_time}+08:00" --region-endpoint="cn-hongkong.log.aliyuncs.com" --format-output=no_escape --jmes-filter="join('\n', map(&to_string(@), @))" \
    24.         --access-id="LTAI9K***OU04GlM" --access-key="R0p1TZF4oomj0kc***valOvA2Xb" >> ${log_status_dir}/drop.txt
    26. #也可以将过滤出来的结果转成csv格式，下到本地分析
    27. Json2csv(){
    28.     /usr/bin/json2csv -i ${log_status_dir}/drop.txt -f EdgeResponseStatus,ClientRequestMethod,ClientRequestHost,ClientIP,ClientRequestUserAgent,ClientRequestReferer,ClientRequestURI,WAFAction,\
    29.             WAFRuleMessage
    30.             -o ${log_status_dir}/drop.csv
    31.     }
    32. #Json2csv
    33. #jq解析json日志,获取攻击IP超过20次的
    34. #/usr/bin/jq -r .ClientIP ${log_status_dir}/drop.txt | sort -n | uniq -c | sort -n|tail -500|awk '{if($1>10) print $2}' >> ${log_status_dir}/block.txt
    36. #use cf api block attack_ip
    38. cf_block(){
    39. IPADDR=$(<${log_status_dir}/block.txt)
    40. for IPADDR in ${IPADDR[@]};do
    41.     echo $IPADDR
    42.     curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONESID/firewall/access_rules/rules" \
    43.             -H "X-Auth-Email: $CFEMAIL" \
    44.             -H "X-Auth-Key: $CFAPIKEY" \
    45.             -H "Content-Type: application/json" \
    46.             --data '{"mode":"block","configuration":{"target":"ip","value":"'$IPADDR'"},"notes":"CC Attatch"}'
    47. done
    48.     }
    49. #cf_block
    50. ~