An attack list becomes more useful when you can connect each event to the public application endpoint it concerns. A hostname alone may be insufficient when an application exposes multiple ports. A port alone may be insufficient when several applications use the same port.

If you are researching how to review WAF attack events split by domain and port, start with the configuration model. The supplied SafeLine documentation explains application domains, listening ports, upstream addresses, and access to attack details. It does not establish a domain-and-port grouping feature in the attack list. The comparison below is therefore a configuration and review checklist, without assuming undocumented dashboard controls.

Choice A: Organize application identity around domains

A domain-oriented configuration makes the hostname the primary reference for operators. Consider two hypothetical public endpoints: shop.example.com:443 and accounts.example.com:443. Both use the same port, so a port-only investigation would not distinguish their application identities.

SafeLine's application setup documents a Domain field that accepts a domain name, hostname, or IP address. It separately defines Port as the port SafeLine listens on and Upstream as the original application's real address. These are distinct configuration values, each with a different role. Source: SafeLine application configuration

Choose a domain-oriented inventory when service ownership and incident response already follow hostnames. Record the complete public endpoint alongside its owner and upstream destination. This gives reviewers a practical reference when deciding which application team should investigate suspicious traffic.

The limitation is that a hostname does not describe every exposure. If one hostname serves applications on multiple ports, your inventory must retain those ports instead of collapsing everything into one domain label.

Choice B: Organize application identity around listening ports

A port-oriented configuration emphasizes which public listener receives requests. For example, portal.example.com:443 and portal.example.com:8443 are different endpoints even though they share a hostname. These are illustrative architecture examples, not claims about an existing deployment.

SafeLine documents listening-port configuration and instructs users to select the SSL option for HTTPS applications. Its setup guide also treats the upstream address separately from that listening port. Consequently, reviewers should distinguish the public listener from the backend destination rather than treating every port number as interchangeable. Source: SafeLine application configuration

Choose a port-oriented inventory when listener changes are a frequent source of operational confusion. For each endpoint, document its hostname, public port, HTTPS setting, and intended upstream.

Its limitation is the reverse of the domain-oriented approach: many applications can be associated with the same familiar port number. A label such as "443 traffic" does not identify an application by itself.

Review with the complete endpoint as your reference

Both choices benefit from the same review procedure:

  1. Establish the expected domain, listening port, and upstream from the application configuration.
  2. Confirm the intended traffic path. SafeLine's documented setup directs the configured domain to the IP address of the server hosting SafeLine after application configuration. Source: application setup
  3. Open the attack list in the web console and select "detail" for an attack. This is the inspection workflow explicitly described in the documentation. Source: attack inspection
  4. Compare the information actually available in the event details with your endpoint inventory. Record any missing context rather than guessing which listener received the request.
  5. Keep observations separate from conclusions. A blocked attack does not, by itself, prove that every intended endpoint follows the expected traffic path.

This approach matches SafeLine's documented role as an HTTP/HTTPS reverse proxy in front of the original application. Configuration context matters because it describes the route through which application traffic is intended to pass. Source: how SafeLine works

Does SafeLine document an attack-event filter combining domain and port?

The supplied sources do not describe such a filter. They document application configuration, an attack list, and a detail action. Verify available controls in your deployment before designing a workflow around combined filtering.

Should I choose domains or ports as the primary label?

Use domains when they map clearly to application ownership. Use ports when distinguishing listeners is the immediate operational concern. In either case, retain the complete domain-and-port pair in your review notes.

Is the console port an application listening port?

Treat them separately. The deployment guide defines MGT_PORT as the web console port, while application setup defines Port as the listener for the protected application. Sources: deployment settings, application settings

What should I do when an event lacks enough endpoint context?

Document the uncertainty and compare the available evidence with the application configuration. Avoid changing protection settings solely to force an event into a domain or port category.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.