Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How do I see the list of blocked requests?
Short answer
On the vService's Event Logs screen, the decision is shown by the icon in the Action column; the icon of a blocked request is red, and when it is hovered over, it reads Attack blocked. To list only the blocked ones, on the server filter tab at the start of the filter strip, with Log Filter → Add Advanced Filter, the WAF · Action field with Equals to → Blocking is selected and Save & Get Logs is clicked. The blocked requests of all vServices are listed with the same filter on the Global WAF Event Log screen. If a periodic summary of the blocked requests or a document to be shared (HTML, PDF, XLSX) is needed, the same condition is set up in the form of WAF Report or, for all vServices, Global WAF Report, in the Report Filter field. If only the count is needed, on the Dashboard, the WAF Blocked Requests panel, or in Live Stats, the Blocked card is used. If the host group is in Learning mode, the list is empty because the request is not blocked.
Problem: Only the Blocked Requests Need to Be Seen
Event Logs lists not only the blocked requests but also the requests passed in Monitor mode, the requests recognized by Teacher and the requests that stay below the blocking threshold and trigger a signature in Monitor state. These appear with a yellow icon in the Action column. To see how many requests were actually blocked or to get a list of only the blocked requests, the decision needs to be filtered. There is no separate tab for the decision in the filter strip; the filtering is done with the Action field in the server filter.
Solution: Four Methods
The methods are alternatives to each other.
| Your situation | Suitable method |
|---|---|
| The blocked requests of a single vService | Method 1: Action filter in Event Logs |
| The blocked requests of all vServices in a single list | Method 2: Global WAF Event Log |
| Not a list, but the number of blocked requests | Method 3: Dashboard, Live Stats and Home |
| A periodic summary of the blocked requests or a document to be shared (HTML, PDF, XLSX) | Method 4: WAF Report and Global WAF Report |
Method 1: Action Filter in Event Logs Recommended
- How it worksLog Filter works on the server side: only the records whose decision is Blocking are fetched, and they are read backward until Line Limit is filled.
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → Event Logs → the server filter tab at the start of the filter strip
- Requirement WAF permission; the host group running in Monitor or Blocking mode
- vService type HTTP (the WAF works only on HTTP vServices)
Step-by-Step Configuration
1
Adım 1 Open the Event Logs screen
In the Left Monitor Panel, the vService is clicked in the WAF-Protected vServices category and the Event Logs tab is selected on the screen that opens (access to Event Logs). By default, the list comes with the newest 1,000 records of the last 7 days.
2
Adım 2 Open the server filter tab
The fixed tab at the start of the filter strip is clicked; the selected time range is written in the title of the tab (e.g. Last 7 day(s)). If the strip is closed, it is first opened with the Filter button on the toolbar. The Date Range, Line Limit, Request Unique ID and Log Filter fields are displayed on the tab.
3
Adım 3 Add an advanced filter
In the Log Filter row, the Add Advanced Filter button is clicked; an empty condition row opens.
4
Adım 4 Define the condition
WAF · Action is selected from the field list, Equals to as the operator and Blocking as the value. The value list contains Blocking, Monitor and Teacher; Monitor also covers the records that stay below the threshold and only trigger a signature in Monitor state. If older records are needed, Date Range is extended on the same tab.
5
Adım 5 Save and list
Save & Get Logs is clicked; the logs are fetched again from the server with the new scope. The button becomes active only when a change is made on the tab; if Line Limit is not between 1 and 20,000 or the time range is invalid, it stays disabled and the faulty field is shown in red.
In a cluster setup, the list combines the records of the two devices; which device a record came from is visible in the Source column (In a cluster, which device do WAF logs come from; how do I distinguish the device in Event Logs?). The list can also be taken as a file: Can I export Event Logs as Excel, CSV or PDF?
Verification
1ListTR7 side
The title of the server filter tab and the icons in the Action column are examined.
Expected
Last 7 day(s) - 1 advanced filter(s); a red icon on every row, tooltip: Attack blockedMethod 2: Global WAF Event Log
- How it worksGlobal WAF Event Log scans the log files of all WAF-protected vServices; the same Action filter is applied to all vServices.
- Where it is openedWAF → Global WAF Event Log
- Requirement WAF permission; an account whose permission is not restricted to specific vServices (how to access)
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Open the Global WAF Event Log screen
The WAF → Global WAF Event Log steps are followed. By default, the list comes with the newest 5,000 records of the last 7 days.
2
Adım 2 Open the server filter tab
The fixed tab at the start of the filter strip is clicked. On this screen, the tab additionally has the vService field; the default All vServices scans all WAF-protected vServices, and with Pick vServices, the vServices to be scanned are selected.
3
Adım 3 Add an advanced filter
In the Log Filter row, the Add Advanced Filter button is clicked.
4
Adım 4 Define the condition
WAF · Action → Equals to → Blocking is selected.
5
Adım 5 Save and list
Save & Get Logs is clicked. If the result does not cover the whole range because the scan budget was exhausted, the Results are complete back to … warning is displayed above the list; in this case, Date Range is narrowed (how the scan works).
Verification
1ListTR7 side
The vService column at the start of the table and the Action icons are examined; when a vService name is clicked, the WAF screen of that vService opens.
Expected
Rows that belong to different vServices, with red icons onlyMethod 3: Dashboard, Live Stats and Home
- How it works Instead of the list of blocked requests, their rate and total are monitored; these panels count only the Blocked result.
- Where it is opened The Dashboard and Live Stats tabs on the vService screen; Header Bar → Home → WAF
- Requirement WAF permission (the WAF screen of the vService, including the Dashboard and Live Stats tabs, opens with this permission; the Home → WAF tab is also visible only with this permission)
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Read the panel on the Dashboard
On the Dashboard tab of the vService screen, in the Summary view, the WAF Blocked Requests panel is examined; the panel shows the rate of the blocked requests in the selected time range; for the total, the view of the panel is switched to Stat Table and the Total column is read (panel metric columns).
2
Adım 2 Read the instantaneous rate
On the Live Stats tab, in the WAF Inspection Distribution section, the Blocked card shows the per-second rate.
3
Adım 3 Compare the vServices
On the Header Bar → Home → WAF tab, the vService Distribution table lists the blocked requests in one row per vService.
Verification
1Count comparisonTR7 side
For the same time range, the Total value on the Dashboard is compared with the record count in the Page Information row below the filtered list in Method 1.
Expected
If Line Limit has not been filled, the two numbers come out closeIf a WAF Log Suppression Condition is defined, the suppressed records do not appear in the list but are counted in the panel.
Method 4: WAF Report and Global WAF Report
- How it works The report produces a summary of the selected period from the same WAF records as Event Logs; with Report Filter, only the records whose decision is Blocking are included in the report. For a single vService, WAF Report is used, and for all vServices, Global WAF Report is used.
- Where it is opened On the vService screen, Dashboard → For Detailed Analysis → WAF Report (or WAF Management → Periodic Reporting card → Generate Report) · WAF → Global WAF Report
- Requirement WAF permission; for Global WAF Report, additionally an account whose permission is not restricted to specific vServices (how to access)
- vService type HTTP
- In a cluster A single report is produced by combining the records of the two devices.
Step-by-Step Configuration
1
Adım 1 Open the report tab
On the vService's Dashboard tab, the For Detailed Analysis → WAF Report shortcut on the toolbar is clicked; a closable WAF Report tab opens on the same screen and the relative time range selected on the Dashboard is passed to the report (how to access). For all vServices, the WAF → Global WAF Report screen is opened.
2
Adım 2 Open the report form
Generate Report on the toolbar is clicked; the report form opens (Generate Report screen).
3
Adım 3 Select the type and the period
Report Type (default html; pdf and xlsx are downloaded as files) and Date are selected. In Global WAF Report, if needed, in the vService field, the vServices to be included in the report are selected with Pick vServices (default All vServices).
4
Adım 4 Turn on the filter
The Report Filter switch is moved from the No Restriction position to the Select position; the first condition row opens.
5
Adım 5 Define the condition
WAF · Action is selected as the field, Equals to as the operator and Blocking as the value.
6
Adım 6 Generate the report
Accept is clicked. Since the ready hourly summaries cannot be used in a filtered report, every record is scanned one by one; the generation takes longer than for an unfiltered report.
Verification
1Filter badgeTR7 side
The filter note at the top of the HTML report and, in the Overview view, the Total Attacks indicator are examined.
Expected
Filtered report (summary of the filter); Total Attacks counts only the blocked recordsIn a filtered report, the traffic charts continue to show all the traffic; the filter narrows only the attack tables (Report Filter).
Other filter examples (a single signature, a single attacker address, category): Can I produce a report containing only certain attacks with the report filter?
Common Mistakes
- Looking for a decision tab in the filter strip. There is no Action tab in the strip; the decision is filtered with the WAF · Action field in the server filter.
- Looking for blocked requests in a host group in Learning mode. In Learning mode, the request is not blocked and no Event Logs record is written; the list appears empty (In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?).
- Thinking that the records with a yellow icon are blocked. The yellow icon shows that the request was passed (Not blocked — …); only the red icon is blocking (What do the Action values in Event Logs mean?).
- Overlooking the row limit. The result is limited to as many records as Line Limit (default 1,000 on the vService screen); for older records, the limit is increased or Date Range is narrowed.
- Looking for requests blocked by a timeout in Event Logs. In Blocking mode, a request that is blocked because its scan could not be completed within the time limit does not write a row to Event Logs; it appears as Attack blocked — scan timed out in Debug Mode Logs while the vService is in Debug mode (Why does a request that received 418 not appear in Event Logs?).
How it is done in the documentation
