Monitoring, Logging, Reporting and Notifications

Dashboard, Event Logs, reports, notifications and SIEM.

• Where do I watch what the WAF is doing?WAF-12-001
• Which tabs does the WAF Dashboard have (Summary, Attack Analysis, Learning); why is the Learning tab not always visible?WAF-12-002
• What are Event Logs; which requests are logged?WAF-12-003
• How do I see the list of blocked requests?WAF-12-004
• Can I see the WAF logs of all vServices on one screen (Global WAF Event Log)?WAF-12-005
• How is a WAF report created; which formats are available in the UI and by e-mail (HTML, PDF, XLSX)?WAF-12-006
• What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?WAF-12-007
• What does the flow diagram on WAF screens (Data Flow Panel) show?WAF-12-008
• What is monitored for the WAF on the Live Stats screen?WAF-12-009
• What do the Action values in Event Logs mean?WAF-12-010
• How are the Severity levels (Blacklist, Structural, Very High … Very Low) determined?WAF-12-011
• How do I filter logs by fields such as IP, country, ASN, path, signature, category, OWASP and CWE?WAF-12-012
• What do I see in a log record's details (Summary, Attacks, Request & Location)?WAF-12-013
• Can I see how long a request spent in the WAF (WAF Time)?WAF-12-014
• Is the request body written to the log?WAF-12-015
• How do I find a specific request by its Request Unique ID?WAF-12-016
• Can I receive reports regularly by e-mail; at what times are they sent?WAF-12-017
• Can I get a single WAF report for the whole device (Global WAF Report)?WAF-12-018
• Can I receive a notification when the attack count exceeds a certain threshold?WAF-12-019
• What are the notification channels (UI, e-mail, SMS, SNMP)?WAF-12-020
• How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?WAF-12-021
• Can I send only attack records to the SIEM?WAF-12-022
• How does scope (Global, Source IP, Source Subnet, Country, ASN, Host Header …) work in advanced notifications?WAF-12-023
• What is the difference between "Blocks" and "Detections" in a notification?WAF-12-024
• Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?WAF-12-025
• Is the attack payload sent to the SIEM (Same as 'detailed log' / Always Send / Never Send)?WAF-12-026
• How do I stop WAF logs of Health Check or probe traffic (WAF Log Suppression Condition)?WAF-12-027
• Can I produce a report containing only certain attacks with the report filter?WAF-12-028
• Can I see the WAF status of all vServices at a glance on the home page?WAF-12-029
• Where do I see the WAF notifications that were sent (Notification Logs)?WAF-12-030
• Can I export Event Logs as Excel, CSV or PDF?WAF-12-031
• Which Event Logs columns are hidden by default; how do I show them?WAF-12-032
• How long are WAF logs kept?WAF-12-033
• How do I set the report language and the maximum number of rows in a report?WAF-12-034
• Can I write advanced filters in Event Logs with AND/OR, NOT, regex and JSONata expressions?WAF-12-035
• What exactly does the WAF Time value measure?WAF-12-036
• In a cluster, which device do WAF logs come from; how do I distinguish the device in Event Logs?WAF-12-037