Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Is the traffic I whitelist logged at all; where does it appear on the dashboard?
Short answer
It is not logged on the WAF side. Since a request that meets the Whitelist Condition or that is counted as static with Do not WAF static contents never enters WAF, no record is written to the Event Logs screen of the vService or to the Global WAF Event Log, it is not added to the learning data, it does not enter the blacklist check and no WAF attack information is produced. The request continues to appear in the HTTP access log of the vService; only if the line format of the log profile is TR7 WAF Log, the exempt request is not written to the access log either, because this format writes only the blocked requests. All traffic, including the exempt requests, can be monitored by sending it to the SIEM with a Logs profile that is assigned to the vService with the LOG option and whose line format is TR7 JSON Format or CEF Format (monitoring all traffic in the SIEM); these formats write every request, and in a request that does not enter WAF the attack information comes empty. On the WAF Dashboard of the vService, these requests are counted in the Whitelisted category in the WAF Inspection Distribution panel and appear as the WHITELISTED path in the flow diagram. Since an attack from an exempt source leaves no WAF record, the exemption is kept narrow.
Where Does It Appear?
| Place | Does the exempt request appear |
|---|---|
| vService Event Logs, Global WAF Event Log | No |
| Learning data and analysis recommendations | No |
WAF attack information (%WAFINFO, SIEM & Attack Details) | Not produced |
| vService HTTP access log / SIEM (Logs profile) | Yes (TR7 JSON Format, CEF Format and the other formats); no if the line format is TR7 WAF Log |
| Dashboard → WAF Inspection Distribution | Counted in the Whitelisted category |
| Dashboard → flow diagram | WHITELISTED path; the exemption decision is shown at the W/B List node |
- Meaning of the categories: What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?
- Difference from Frontend blacklist exclusions: The addresses in this list are not exempt; they pass through the WAF inspection and their records are written to Event Logs (How do I define a vService-specific IP blacklist (Frontend Blacklist) and its exclusions (Frontend Blacklist Exclusions)?).
- Difference from WAF log suppression condition: With this setting, the request is inspected and blocked if needed; the WAF record is written but is not shown in the Event Logs list and does not enter the AI Learning/Teacher evidence (WAF Log Suppression Condition; details: How do I stop WAF logs of Health Check or probe traffic (WAF Log Suppression Condition)?).
- Sources that should be inspected but not blocked: Instead of the whitelist, a separate host group in Teacher or Monitor mode is used; this way a record is produced (How do I make sure a certain user group (e.g. internal network, test team) is never blocked?).
Monitoring All Traffic in the SIEM
Since Event Logs shows only the requests that have a WAF record, monitoring that also covers the exempt traffic is done with the access log of the vService. The access log is sent to the SIEM with the Logs profile assigned to the vService (SIEM integration).
1
Adım 1 Open the Logs profile form
On the Load Balancer → Profiles → Logs screen, Add is clicked (profile add form).
2
Adım 2 Write the SIEM server
Name is given. In the Log Addresses row, Protocol (default UDP) is selected, and the IP address of the SIEM server and the Port it listens on (e.g. 514 for syslog) are entered; no log is sent to an address whose port is left empty. Log Standard (default local) is selected according to the syslog format the SIEM expects.
3
Adım 3 Select the line format
TR7 JSON Format or CEF Format is selected in the Line Format list. These formats write every request, including the exempt requests; in a request that does not enter WAF, the attack information (wafInfo) comes empty. TR7 WAF Log is not selected: this format writes only the blocked requests.
4
Adım 4 Save the profile
Add is clicked.
5
Adım 5 Open the vService edit form
On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected. Editing the vService form requires modify permission in the Load Balancer area.
6
Adım 6 Check LOG and select the profile
LOG is checked in the Details list on the right of the form; the profile from step 4 is selected from the Log Profile list opened with the arrow next to the row (how to add it to a vService). The built-in Stream Log in the list does not send to any server; it is not selected for the SIEM.
7
Adım 7 Save
Save is clicked. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.
- Content of the attack information: Which fields the attack information added to the log line will carry, and whether the payload will be sent, is set from the SIEM & Attack Details card; the card determines only the content, not the destination.
- Verification: After a request is sent from the exempt source, the line of that request appears in the SIEM and the attack information in the line is empty.
Common Misconceptions
- "A whitelisted attack is recorded as in Monitor mode." No WAF record is produced at all; the request is only added to the Whitelisted count on the Dashboard.
- "Log suppression and the whitelist are the same." Suppression only suppresses the listing of the record; the inspection and the blocking continue.
- "The exempt request does not appear in the access log either." It appears in the access log; only the TR7 WAF Log line format does not write the requests that are not blocked.
- "The SIEM & attack details card sends the logs to the SIEM." The card only determines the content of the attack information; the sending is done by the Logs profile assigned to the vService.
How it is done in the documentation
Related questions
