Does "Add to Whitelist (vService)" in Event Logs exempt an IP from WAF inspection, or does it only add a blacklist exclusion?

Short answer

It only adds a blacklist exclusion. In Event Logs, Add to whitelist (vService name), which is in the menu next to the Attacker IP address on the Summary tab of the record preview, writes the address to the Frontend Blacklist Exclusions list of this vService after the confirmation and deletes it from the Frontend Blacklist if it is there. As a result, on this vService no Blacklisted IP violation is produced for that address either from the vService's own blacklist or from the IP Intelligence & Reputation blacklist; the request continues to pass through the WAF inspection and can still be blocked with a signature or structural violation. The information text in the form also states this: It is NOT a WAF whitelist. The operation can be done only while Blacklist Protection is on. For complete exemption from WAF inspection, Whitelist Condition is used, and for a false positive, Allow / Teach is used.

Comparison of the Options

Operation	Where it writes	Effect
Add to whitelist (vService name)	The Frontend Blacklist Exclusions list of this vService	No blacklist match is produced on this vService; the WAF inspection continues
Add to Whitelist (IP intelligence)	The device-wide IP Intelligence & Reputation list	Affects all vServices (What is the difference between the vService blacklist and the IP intelligence list?)
Whitelist Condition + Source IP condition	The WAF setting of the vService	The request never enters WAF, no record is produced (Can I exempt certain IPs or requests from WAF inspection entirely (Whitelist Condition)?)
Allow / Teach	The rule of the related page type	The false positive is taught to the rule; the inspection continues (How do I allow a request that was blocked by mistake?)

• Confirmation: The selection is confirmed with the question Add this address to the whitelist of the service …, ahead of every blacklist?.
• Prerequisite: Blacklist Protection must be on; while it is off, the Please turn on blacklist protection first error is given.
• Undoing: While the address is in the list, Remove from whitelist (vService name) appears in the same menu.
• Editing the lists manually: How do I define a vService-specific IP blacklist (Frontend Blacklist) and its exclusions (Frontend Blacklist Exclusions)?

Common Misconceptions

• "An IP added to the whitelist is no longer blocked." Only the blacklist match is removed; requests that contain a signature or structural violation continue to be blocked.
• "The operation affects the whole device." The option that ends with (vService name) affects only that vService, and the option that ends with (IP intelligence) affects all vServices.
• "The operation removes the records from Event Logs." Since the request continues to be inspected, requests that contain an attack continue to be recorded.

How it is done in the documentation

• Event Logs · Summary Tab
• Whitelist & Blacklist · Frontend Blacklist Exclusions
• Whitelist & Blacklist · Whitelist Condition

Related questions

• Can I exempt certain IPs or requests from WAF inspection entirely (Whitelist Condition)?
• How do I define a vService-specific IP blacklist (Frontend Blacklist) and its exclusions (Frontend Blacklist Exclusions)?
• How do I allow a request that was blocked by mistake?