Which decisions does the WAF make for a request; what do Action in Event Logs and Verdict in Debug Mode Logs mean?

Short answer

Every request comes out of the WAF with a single result, and the results are counted as six series in the WAF Inspection Distribution chart on the Dashboard: Whitelisted (not inspected because it matched an exemption), Clean (inspected, not blocked), Blocked (the score reached the threshold, blocked in the Blocking mode), Monitor (the score reached the threshold but it was let through because the group is in the Monitor mode), Teacher (the score reached the threshold but it was let through because the request came with the Teacher identity) and Learning (written to the learning record because it was in the Learning mode or came with the Conditional Learning identity). The Action column in Event Logs shows the decision of the written attack record with an icon; when the pointer is moved over the icon, the sentence "Attack blocked", "Not blocked — Monitor mode", "Not blocked — Below the blocking threshold" or "Not blocked — Teacher IP matched" (Teacher cookie or Teacher header according to the identity) appears. Verdict in the WAF section of Debug Mode Logs shows the same sentences per request; a State = Monitor hit that stays below the threshold is written there as "Not blocked — Below the blocking threshold" independently of the mode of the group. A request whose scanning does not finish within the 2-second time limit is blocked in the Blocking mode (let through if Fail-open is on), and in the other modes it is let through, except for an exception that can occur while the rules are being loaded; this blocked request is not written to Event Logs, and if Debug mode is on, it appears in Debug Mode Logs as "Attack blocked — scan timed out".

How Does It Work?

The result is determined after the scanning has finished, according to the first matching condition in the following order: timeout → Whitelisted → Learning → Teacher → Monitor → Blocked → Clean. For this reason, a request that contains an attack in a group in the Learning mode is also counted as Learning.

Result (WAF Inspection Distribution)	When	Event Logs · Action
Whitelisted	Within the scope of Do not WAF static contents or Whitelist Condition, or an AGS authentication request, an Advanced CAPTCHA verification request or the client proof request that the Bot/DDoS verification page sends to the product; the request did not enter the WAF	No record
Learning	The group is in the Learning mode or the request came with the Conditional Learning identity	No record; the request is written to the learning record
Teacher	Score ≥ threshold, the request came with the Teacher identity; the request was let through	"Not blocked — Teacher IP matched" (Teacher cookie or Teacher header according to the identity)
Monitor	Score ≥ threshold, the group is in the Monitor mode; the request was let through	"Not blocked — Monitor mode"
Blocked	Score ≥ threshold, the group is in the Blocking mode; the request was blocked	"Attack blocked"
Clean	The score stayed below the threshold	No record is written; the only exception is the triggering of a signature whose State is Monitor: "Not blocked — Below the blocking threshold" in a Blocking group, "Not blocked — Monitor mode" in a Monitor group, and "Not blocked — Teacher IP matched" (Teacher cookie or Teacher header according to the identity) for a request that comes with the Teacher identity
Timeout (no separate series in the chart)	The scanning did not finish within the 2-second time limit; the request was blocked in the Blocking mode (let through if Fail-open is on), and let through in the other modes	No record; for the blocked request, "Attack blocked — scan timed out" in Debug Mode Logs

• The Blocking Status Code (default 418) and the blocking page are returned to the blocked request; a request blocked by timeout receives the same response as well.
• The Action column in Event Logs shows an icon, not text; there are three lanes: blocking, monitoring and Teacher (Action values). Even if the signatures of a record are taught later, the icon continues to show the decision at the moment the record was created.
• Debug Mode Logs are written only while the Status field of the vService is in Debug mode (how debug logs are enabled); the WAF section is filled only in the requests for which the WAF produces a record and in the requests blocked by timeout. Verdict does not appear in Learning, Whitelisted and Clean requests that produce no record. Verdict is the same as the sentences in Event Logs; the only difference is that a State = Monitor hit that stays below the threshold is always written here as "Not blocked — Below the blocking threshold" and that the Teacher name is not shown.

In which mode a record is created: In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?

Common Misconceptions

• "If Event Logs is empty, there is no attack." In the Learning mode and for hits that stay below the threshold, no Event Logs record is written.
• "A request blocked by timeout appears in Event Logs." It appears only in Debug Mode Logs; it is not shown as a separate series in the WAF Inspection Distribution chart either.
• "The Monitor series counts all requests whose signature is monitored." The Monitor series counts only the requests whose score reaches the threshold in a group in the Monitor mode; a request that is caught by a signature whose State is Monitor and stays below the threshold is counted as Clean.

How it is done in the documentation

• Event Logs · The Action Values
• Dashboard · WAF Inspection Distribution
• WAF Mode · Runtime Behavior of the Modes
• Debug Logs · What Are Debug Logs?

Related questions

• In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?
• Legitimate users are being blocked; how do I find which rule is blocking them?
• I am blocking legitimate users by mistake; how do I find out?