Where do I watch what the WAF is doing?

Short answer

There is a separate screen for each question. The total of all WAF-protected vServices on the device is on the WAF tab of the Home screen. For a single vService, in the Left Monitor Panel, the vService is selected from the WAF-Protected vServices category: Dashboard shows the periodic charts, Live Stats the current per-second values, and Event Logs the recorded requests one by one with their reasons; if Teacher or AI Learning is on, the learning monitoring tab (AI Learning & Teacher Tracking) lists the learning history. The records of all vServices are searched on the Global WAF Event Log screen; for a document, WAF Report (single vService) or Global WAF Report (all vServices) is generated. Threshold breaches are notified with the Notifications setting, and the sent notifications are seen on the Notification Logs screen; the records are sent to the SIEM with the Logs profile.

Which Question, Which Screen

Question	Screen	Where it is opened	Details
What is the status across the device?	Home → WAF	Header Bar → Home → WAF	Can I see the WAF status of all vServices at a glance on the home page?
What happened on this vService over a period?	Dashboard	Left Monitor Panel → WAF-Protected vServices → vService; the screen opens with the Dashboard tab that carries the name of the vService	Which tabs does the WAF Dashboard have (Summary, Attack Analysis, Learning); why is the Learning tab not always visible?
What is happening right now?	Live Stats	The Live Stats tab on the same screen	What is monitored for the WAF on the Live Stats screen?
Why was this request blocked?	Event Logs	The Event Logs tab on the same screen	What are Event Logs; which requests are logged?
Search for a record across all vServices	Global WAF Event Log	WAF → Global WAF Event Log	Can I see the WAF logs of all vServices on one screen (Global WAF Event Log)?
A document of a period	WAF Report · Global WAF Report	For Detailed Analysis → WAF Report on the Dashboard · WAF → Global WAF Report	How is a WAF report created; which formats are available in the UI and by e-mail (HTML, PDF, XLSX)?
Notify when a threshold is exceeded	Notifications	WAF Management tab → Notifications card	Can I receive a notification when the attack count exceeds a certain threshold?
Sent notifications	Notification Logs	Settings → System Logs → Notification Logs	Where do I see the WAF notifications that were sent (Notification Logs)?
Transfer the records to the SIEM	Logs profile + SIEM & Attack Details	Load Balancer → Profiles → Logs · WAF Management tab	How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?
What was learned?	AI Learning & Teacher Tracking	The learning monitoring tab on the same screen	How do I see what AI Learning and Teacher applied in the past?

• The learning monitoring tab is added only while Teacher or AI Learning is on; its name becomes AI Learning Tracking, Teacher Tracking or AI Learning & Teacher Tracking according to the method that is on.
• The whole WAF screen of the vService (the Dashboard, WAF Management, Event Logs, Live Stats and learning monitoring tabs) requires monitoring permission in the WAF area; once the screen is opened, the tabs are not separately bound to a permission. For a user who has only Load Balancer permission, this screen does not open (permission condition). Global WAF Event Log and Global WAF Report do not appear in the menu for accounts whose permission is restricted to specific vServices (how to access).
• In a cluster setup, each of these screens combines or separates the data of the two devices in its own way: In a cluster, which device do WAF logs come from; how do I distinguish the device in Event Logs?

Common Misconceptions

• "Live Stats shows the history." Live Stats shows only the instantaneous values and does not store data; the history is on the Dashboard.
• "Every request that the WAF inspects has a record in Event Logs." Event Logs lists only the requests that reach the blocking threshold or trigger a signature in Monitor state. Requests in Learning mode, requests within the scope of Conditional Learning, as well as requests that stay below the threshold and do not trigger a signature in Monitor state either, do not enter the list; records that match the condition in the WAF Log Suppression Condition field are not shown in the list either. The WAF Inspection Distribution panel on the Dashboard, on the other hand, counts all requests that come to the vService according to the result that the WAF gives (In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?).
• "The Event Logs screen updates on its own." The list is fetched on opening, with Refresh and when the server filter is changed; live tracking is done with Live Stats.

How it is done in the documentation

• WAF-Protected vServices · Division of Labor Between Tabs
• Dashboard · What Is Dashboard?
• Event Logs · What Is Event Logs?
• Home Dashboard · WAF

Related questions

• Can I see the WAF status of all vServices at a glance on the home page?
• What are Event Logs; which requests are logged?
• Where do I monitor the current status of my vService?