Can I blacklist an attacker IP directly from Event Logs (Attacker IP → Actions)?

Short answer

Yes. On the WAF Event Logs screen, the record is opened; one of two scopes is selected from the Actions menu next to the Attacker IP row on the Summary or Request & Location tab of the preview. Add to Blacklist (<vService-name>) writes the address only to the Frontend Blacklist list of this vService. Add to Blacklist (IP intelligence) writes the address to the IP Intelligence & Reputation user blacklist of the device and affects all vServices on which Blacklist Protection is on. Each option opens a confirmation window that shows the address and the country; after it is confirmed, the change is applied without a separate deployment step. Subsequent requests exceed the blocking threshold on their own with the Blacklisted IP violation: they are blocked in host groups in Blocking mode and only recorded in Monitor mode. For the service scope, Blacklist Protection must be on in the vService. The menu changes according to the state of the address: for an address that is in the list, the Remove from Blacklist option is offered, and for a blacklist record that comes from a reputation feed, only the option of adding to the whitelist is offered in the IP intelligence scope. If the address attacks more than one vService, the device-wide scope is selected; if it targets a single application, the service scope is selected.

Problem: An Attacker Address Keeps Making Attempts

Repeated attacks from the same address are seen in Event Logs; the address needs to be blacklisted without leaving the record screen.

Solution: 2 Methods

Your situation	Suitable method
The address is seen in an Event Logs record	Method 1: Attacker IP → Actions
More than one address or block will be entered manually	Method 2: Frontend Blacklist

Method 1: Attacker IP → Actions Recommended

• How it works The address in the record is written to the Frontend Blacklist list of the vService or to the IP intelligence user blacklist with the confirmed menu option (What is the difference between the vService blacklist and the IP intelligence list?).
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → Event Logs tab → record → Summary → Attacker IP → Actions
• Requirement Modify permission in the WAF area; Blacklist Protection on in the vService (it is on by default)
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Check Blacklist Protection

On the WAF Management tab, the Requests from bad-reputation source IPs are blocked — category: … row must appear on the Whitelist & Blacklist card in the Inspection & Blocking section. If the card shows that Blacklist Protection is off, the window is opened with the pencil icon of the card, the Blacklist Protection switch is turned on and Edit is clicked (Can I automatically block requests from IPs with a bad reputation (Blacklist Protection)?).

2

Adım 2 Open the Event Logs screen

The Left Monitor Panel → WAF-Protected vServices → vService → Event Logs tab is opened.

3

Adım 3 Fetch the records

In the server filter, Date Range is selected and Save & Get Logs is clicked.

4

Adım 4 Open the record

One of the attacker's records is clicked; the preview opens on the right.

5

Adım 5 Open the Actions menu

The Actions menu next to the Attacker IP row on the Summary (or Request & Location) tab is opened.

6

Adım 6 Select the scope

Add to Blacklist (<vService-name>) is selected for this vService only, and Add to Blacklist (IP intelligence) for all vServices.

7

Adım 7 Confirm

In the window that opens, the question (Add this address to the blacklist of the service <vService-name>? or Add this address to the blacklist on every service?) and, below it, the address and the country appear; Yes is clicked. In a cluster, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually with Synchronize.

The same menu is also found in other places; in the right-click menu of the row, on the other hand, there is only Allow / Teach:

Place	Difference
The information window of the address in the Client IP tab of the Event Logs filter strip	The same options
Attacker IP in the Global WAF Event Log preview	The service-scoped options appear with the name of the vService the row belongs to; the information window in the filter strip does not offer the service scope

Verification

1Whitelist & Blacklist cardTR7 side

In the service scope, the row of the card on the WAF Management tab is checked.

ExpectedN pool-specific blocks and X exclusions are defined for this vService

When the menu is opened again, the Remove from Blacklist option appears for the same address.

2Subsequent recordsTR7 side

The Attacks tab of a subsequent record of the address is checked.

ExpectedBlacklisted IP · Attack blocked

If the host group is in Monitor mode, the decision becomes Not blocked — Monitor mode.

Method 2: Frontend Blacklist

• How it works The addresses and blocks are written line by line to the Frontend Blacklist field of the vService.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Inspection & Blocking → Whitelist & Blacklist card
• Requirement Modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the window

On the WAF Management tab, the pencil icon at the top right of the Whitelist & Blacklist card is clicked (Whitelist & Blacklist Edit screen).

2

Adım 2 Turn on Blacklist Protection

If the Blacklist Protection switch is off, it is turned on; the Frontend Blacklist field appears and is applied only while this switch is on.

3

Adım 3 Write the addresses

One IP address or CIDR block per line is written in the Frontend Blacklist field (e.g. 198.51.100.77).

4

Adım 4 Save

Edit is clicked. Details: How do I define a vService-specific IP blacklist (Frontend Blacklist) and its exclusions (Frontend Blacklist Exclusions)?

Verification

1Whitelist & Blacklist cardTR7 side

The row of the card is checked.

ExpectedN pool-specific blocks and X exclusions are defined for this vService

Common Mistakes

• Using the service scope while Blacklist Protection is off. The server rejects the operation and the address is not written to the list; Blacklist Protection is turned on first.
• Expecting blocking in Monitor mode. A blacklist hit is also subject to the mode of the host group; in Monitor mode it is only recorded, and in Learning mode it is not blocked and is not written to Event Logs.
• Adding a shared egress address (corporate NAT, CDN) to the list. All users behind the address are blocked; behind a CDN, if the real client address is not resolved, the address of the CDN is blocked.
• Trying to remove a record that comes from a reputation feed. A feed record cannot be removed from the menu; if the address is needed, it is added to the whitelist. If the address is in the vService's own whitelist (Frontend Blacklist Exclusions), the option of adding it to the blacklist for that vService does not appear in the menu.
• Confusing the blacklist with the WAF whitelist. The Add to Whitelist options remove only the blacklist hit; the requests of the address continue to go through WAF inspection (Does "Add to Whitelist (vService)" in Event Logs exempt an IP from WAF inspection, or does it only add a blacklist exclusion?).

How it is done in the documentation

• Event Logs · Summary Tab
• Whitelist & Blacklist · Frontend Blacklist
• Global WAF Event Log · Operational Best Practices

Related questions

• How do I define a vService-specific IP blacklist (Frontend Blacklist) and its exclusions (Frontend Blacklist Exclusions)?
• What is the difference between the vService blacklist and the IP intelligence list?
• Can I automatically block requests from IPs with a bad reputation (Blacklist Protection)?