What do the Action values in Event Logs mean?

Short answer

The Action column shows an icon, not text, and places the record in one of three lanes: blocking (red, prohibition sign), monitoring (yellow, binoculars) and Teacher (yellow, blackboard). When the icon is hovered over, the decision sentence appears: Attack blocked means the request was blocked; Not blocked — Monitor mode means the request was let through because the host group is in Monitor mode (the score has reached the threshold or a signature in Monitor state has been triggered); Not blocked — Below the blocking threshold means the host group is in Blocking mode but the score did not reach the threshold, and the record was written because a signature in Monitor state was triggered; Not blocked — Teacher IP matched, Not blocked — Teacher cookie matched or Not blocked — Teacher header matched means the request was recognized by the Teacher source named in the sentence and let through. The icon shows the decision at the moment the record was formed; it does not change even if the record is taught later. In the export, the short counterpart (Blocking, Monitor, Monitored rule or the name of the Teacher source, e.g. Teacher IP) is written instead of the icon; the Action field in the server filter takes the Blocking, Monitor and Teacher values.

Values

Icon	Tooltip sentence	What happened?	Value in the export	Log filter → Action
Prohibition sign, red	Attack blocked	The score reached the threshold and the host group is in Blocking Mode; the request was blocked	Blocking	Blocking
Binoculars, yellow	Not blocked — Monitor mode	The host group is in Monitor Mode; the score reached the threshold or a signature in Monitor state was triggered, and the request was let through	Monitor	Monitor
Binoculars, yellow	Not blocked — Below the blocking threshold	In the group in Blocking mode, the score did not reach the threshold; the record was written because a signature in Monitor state was triggered	Monitored rule	Monitor
Blackboard, yellow	Not blocked — Teacher IP matched · Not blocked — Teacher cookie matched · Not blocked — Teacher header matched (Not blocked — Teacher matched if the Teacher source has not been written to the record)	The request came from the Teacher source; it was let through	The name of the Teacher source (Teacher IP, Teacher cookie, Teacher header; Teacher if there is no source)	Teacher

• The Teacher lane uses the same color as the monitoring lane, because in both cases the request has been let through; the icon makes the distinction.
• The same icon and sentence also appear in the title of the preview window (preview of the selected log).
• The conceptual explanation of the decisions and their Debug Mode Logs counterpart: Which decisions does the WAF make for a request; what do Action in Event Logs and Verdict in Debug Mode Logs mean?
• In the attack information sent to SIEM, the same decision appears in the action key as block, monitor or fpc (Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?).

Taught Records

When all the signatures in a record are taught, the row turns pale green and the first number of the Attacks column becomes 0. The Action icon, however, does not change: teaching changes not the past decision but the work that remains in today's rule set. When the row is clicked and its preview is opened, the highlight of the row takes effect; the icon and the green tone lose their own color at that moment.

Common Misconceptions

• "The Action value of a taught record changes." The icon keeps the decision at the moment the record was formed; teaching is seen in the Attacks column and in the row color.
• "The two monitoring sentences are the same thing." The Monitor mode record is written while the host group is in Monitor mode; if the score has reached the threshold, the request would have been blocked had the group been in Blocking mode. The Below the blocking threshold record is written in a group in Blocking mode; the request has passed because the score did not reach the threshold, and the record has been produced by the signature in Monitor state.
• "The yellow icon is orange or means an error." Yellow is the warning color of the theme and shows that the request has been let through; blocking is only the red icon.
• "A request blocked by a timeout appears in the Action column." In Blocking mode, a request that is blocked because its scan could not be completed within the time limit is not written to Event Logs, so it does not appear in the Action column. This decision appears in Debug Mode Logs as Attack blocked — scan timed out only while the vService is in Debug mode; its counterpart in the Security Action filter is WAF · Timeout (Why does a request that received 418 not appear in Event Logs?).

How it is done in the documentation

• Event Logs · The Action Values
• Event Logs · The Attacks Column
• Event Logs · Export Table

Related questions

• Which decisions does the WAF make for a request; what do Action in Event Logs and Verdict in Debug Mode Logs mean?
• In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?
• How do I see the list of blocked requests?