How to Set Up SafeLine for Reviewing WAF Attack Events by Domain and Port

When several websites share a WAF, an attack event needs context: which hostname received the request, which public port handled it, and which application was behind that endpoint. Reviewing those boundaries helps an operator investigate the correct service and avoid confusing public listeners with backend connections.

If you are searching for how to review WAF attack events split by domain and port, start with a clear application inventory. The supplied SafeLine documentation explains how to configure application domains and listening ports, then inspect the attack list and individual attack details. It does not establish a dedicated domain-and-port grouping feature or document corresponding event filters. The following setup guide uses those documented capabilities and a separate review checklist.

1. Prepare the deployment host

Check the installation prerequisites before setting up your application inventory. The official guide lists Linux, Docker version 20.10.14 or above, Docker Compose version 2.0.0 or above, and a minimum environment of one CPU core, 1 GB of memory, and 5 GB of disk space. It also lists supported architectures and CPU instruction requirements. Review the architecture notes carefully: the guide states that ARM installations require a Pro license and that the Personal Edition does not support ARM. Source: SafeLine installation guide.

For a practical preflight check, use the documented commands uname -m, docker version, docker compose version, free -h, and df -h. Compare the results with the complete requirements in the guide before continuing.

2. Install SafeLine and access the console

Follow the official installation guide's automated or manual deployment procedure. The automated procedure requires root privileges. After installation, the guide directs administrators to open https://<safeline-ip>:9443/ and obtain administrator credentials with docker exec safeline-mgt resetadmin. Source: deployment and console access.

Record the console address separately from your application endpoints. Port 9443 in this procedure is the management console port; the application listener is configured in the next step. Keeping these entries separate makes the eventual review worksheet easier to interpret.

3. Map each intended domain and listening port

Before adding an application, prepare a worksheet with these columns:

• Application name and owner.
• Public domain or hostname.
• Public listening port.
• Whether HTTPS is intended.
• Upstream application address.
• Validation time and review notes.

In the SafeLine console, open Applications and select Add Application. The documented configuration includes Domain, Port, and Upstream. Domain identifies the original application's domain, hostname, or IP address. Port is the port SafeLine listens on, such as 80 or 443. Upstream is the original application's real address, to which SafeLine forwards traffic. For HTTPS applications, the guide instructs you to select the SSL option. Source: application configuration.

Treat the public domain and listening port as a pair in your worksheet. An upstream port describes a different connection and should have its own entry.

4. Route and validate each endpoint separately

After configuring the application, resolve its domain to the IP address of the server running SafeLine, as the application guide instructs. SafeLine operates as an HTTP/HTTPS reverse proxy: it receives traffic for the website and forwards permitted traffic to the original application. Source: traffic flow and domain configuration.

Validate one endpoint at a time. First, visit an ordinary application page and record the hostname, port, and time. Then, on an application you control and are authorized to test, use a suitable test case from the official guide. That guide supplies examples for SQL injection, XSS, path traversal, code injection, and XXE, and describes a blocking page as evidence that SafeLine defended against the test request. Source: application attack tests.

5. Review the attack list against your worksheet

After each controlled test, inspect the attack list in the SafeLine web console. The official guide instructs users to click detail to view specific attack information. Source: attack list and details.

Compare the available information with your recorded endpoint and test time. Record only what the console actually shows. If a domain, destination port, filter, or grouping control is absent, do not infer that it exists from the application configuration fields.

For routine reviews, use one worksheet row per domain-and-port pair. Record the review period, observed events, supporting details, and unresolved attribution questions. Keep uncertain events explicitly marked as uncertain. This creates a repeatable investigation process without depending on undocumented reporting capabilities.

FAQ

Does SafeLine document an automatic domain-and-port event split?

The supplied sources document application domain and port configuration, an attack list, and attack details. They do not describe an automatic combined grouping or filtering feature. Verify the controls available in your installed version before designing a workflow around them.

Is the application listening port the same as the upstream port?

They describe different connection points. The documentation defines Port as the listener on SafeLine and Upstream as the original application's address. Keep both in your inventory so a backend connection does not get mistaken for the public endpoint. Source: configuration fields.

What should I check if a test does not produce the expected result?

Recheck the configured domain, listening port, HTTPS selection, upstream address, and domain resolution against the application guide. Repeat a single authorized test and record its time. An unexpected result alone does not establish which part of the traffic path needs correction.

Can this procedure produce reliable per-port attack totals?

Only if the available event evidence supports that attribution. A configured listener does not by itself prove that every event exposes its destination port. Keep totals limited to events you can attribute, and document gaps before using the results for operational decisions.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

• SafeLine website: https://ly.cyberserval.tech/bvK1BAV
• Demo: https://demo.waf.chaitin.com:9443/statistics
• Official docs: https://docs.waf.chaitin.com/en/home
• GitHub: https://github.com/chaitin/SafeLine
• Pro offer: https://cyberserval.tech/landing/lto