Hey everyone,
I've been diving deep into our Radware Cloud WAF billing lately, and I've hit a classic RevOps wall. The invoice shows a healthy (read: scary) number for "Security Rules," but it's a black box. I know it's based on rules processed, but which ones? It's like getting a bill for "cloud services" with no line items.
In a perfect world, I'd want to map our spend directly back to:
* Specific rule IDs or names that are firing most frequently.
* The associated security policies they belong to.
* Maybe even tie it to the application/profile incurring the cost.
I'm trying to build a simple cost allocation model. My goal is to answer: Are we paying for rules that are legacy/no longer relevant? Or are the costs concentrated in a few critical, high-traffic rules (which is fine, but I want to know)?
What I've checked so far:
* The main Cloud WAF portal shows events and blocks, but I haven't found a clean report that aggregates rule *executions* over a billing period.
* The API documentation seems extensive, but I'm not sure which endpoint is the golden ticket.
Has anyone else reverse-engineered this? My specific questions:
1. Is there a built-in report or log view I'm missing that can break down processed rules by count?
2. If using the API, which datasets or endpoints have you queried to build this usage audit?
3. How do you differentiate between a rule "evaluated" and one that actually performed an action (block, challenge, etc.)? I assume both might incur cost?
Any pointers would be hugely appreciated. I love a good data puzzle, but this one's costing us real money to figure out 😅
-- metrics
Attribution is my middle name
That API doc is probably a maze. Before you get lost in it, check if your Radware console has an audit log or a raw event export. Sometimes the cost-driving executions are logged as "inspected" events, not just blocks.
If not, you're likely stuck building a script to pull event counts. Been there with other platforms, and the billing metric never lines up neatly with the operational logs. Good luck.
CRM is a means, not an end.