What do I see in a log record's details (Summary, Attacks, Request & Location)?

Short answer

When a record is clicked in Event Logs, the preview opens on the right; in the title there are the icon and the sentence of the decision, below it the unique ID of the request and the copy icon, and at the top right the teaching button that takes the name Allow or Teach according to the decision. The Summary tab shows the Category, OWASP Web, OWASP API, CWE, CAPEC, MITRE ATT&CK, Target and Signature distribution of the attacks in a ring chart, and below it the Attacker IP, Request (method and path) and classification lists. The Attacks tab lists the attacks; for the selected attack, it carries the Corresponding Rule, Attack Name (with its level), Attack ID, Attack Area, Argument, Description (which highlights the matching section) and Learning Suggestion rows, and the Edit Corresponding Rule and teaching buttons. The Request & Location tab shows Date, Host Group, Host, HTTP(s) Method, Path, Matching Path Rules, Query, HTTP Headers, Body if it has been recorded, WAF Time, the Monitor Mode or Teacher row when applicable, and the client section (Attacker IP, Attack Network, Ip Provider, Attacker Location, Attacker User-Agent). The last viewed tab is remembered per user.

Title

Item	Content
Decision	The same icon as in the Action column, and its sentence (e.g. Attack blocked, Not blocked — Teacher IP matched)
Request ID	It is copied to the clipboard with the copy icon; it is used to find the same record in the Request Unique ID field in the server filter
Teaching button	Allow on a blocked record, Teach on a record that was monitored or let through by Teacher; after the confirmation, it directly teaches the visible attacks of the record (the Allow / Teach button in the title)

Tabs

The preview has three tabs: Summary summarizes the record as a whole, Attacks opens the attacks in the record one by one, and Request & Location shows the request itself and the client.

Summary

It is the classification summary of all the attacks of the record (Summary tab).

Field	What does it show?
Ring chart	The distribution of the selected dimension. The dimensions (Category, OWASP Web, OWASP API, CWE, CAPEC, MITRE ATT&CK, Target, Signature) are changed with the arrows on the two sides of the chart or with the dots below it; the selection is stored per user.
Attacker IP	The address that sent the request, with the country flag. With the Actions menu next to it, the address is added to the blacklist or the whitelist only for this vService or in the device-wide IP Intelligence & Reputation lists.
Request	The HTTP method and path of the request (e.g. GET /application_default_credentials.json); the full path appears in the tooltip.
Signature	The names of the triggered signatures
Category	The attack categories of the triggered signatures (e.g. Arbitrary File Read)
OWASP Web / OWASP API	The OWASP Top 10 Web (e.g. A01:2021) and OWASP API Top 10 counterparts of the signatures
CWE / CAPEC / MITRE ATT&CK	The weakness (e.g. CWE-219), attack pattern and technique (e.g. T1005) codes of the signatures
Target	The technology or component the signatures target (e.g. File System)

The number next to the titles is the number of different values in that field; a title that carries no value is not listed.

Attacks

It examines the attacks in the record one by one and shows why the selected attack was caught (Attacks tab). In the table at the top, every attack is listed with the Attack Area (the section of the request in which it was caught; with the @parameter suffix if it was caught on a parameter) and Attack Name columns; when the tab is opened, the first attack is selected. The attacks for which no change remains to be made in the rule set are written in green.

Field	What does it show?
Corresponding Rule	The page type rule the attack matched; Any Paths for a request that matches no path pattern
Attack Name	The name of the signature and its level in parentheses (e.g. GCP Credentials File Access (Very high))
Attack ID	The number of the signature; it is searched with this number on the Signature & Rule Library screen
Attack Area	The check field in which the attack was caught (path, query, header, form, JSON, XML or raw body)
Argument	The parameter on which the attack was caught; it appears only for an attack caught on a parameter
Description	The section of the request that matches the signature, with the matching part highlighted
Learning Suggestion	What the teaching operation will do: adding the signature to the OWASP exclusion, adding to or removing from a list, updating the rule, turning off the check or adding the address to the blacklist exclusion; Already learned if no change remains
Category, OWASP Web, OWASP API, CWE, CAPEC, MITRE ATT&CK, Target	The classifications of the selected attack only

Edit Corresponding Rule above the details opens the edit form of the rule (or of the check field) the attack matched; Allow / Teach teaches only the selected attack.

Request & Location

It shows the request itself and the client that sent the request (Request & Location tab).

Field	What does it show?
Date	The date and time the request was processed, with milliseconds
Host Group	The host group the request falls into according to its Host header; the rule set and the mode come from this group
Host	The Host header in the request
HTTP(s) Method	The HTTP method of the request
Path	The requested path; the full value appears in the tooltip
Matching Path Rules	The page type rules the request matched and the check fields defined in each of them
Query	The query parameters, as name and value
HTTP Headers	The headers of the request, as a name and value list
Body	The request body; it appears only if the body has been written to the record (Is the request body written to the log?)
WAF Time	The time the WAF inspection spent on this request (What exactly does the WAF Time value measure?)
Monitor Mode	Only on a record evaluated in Monitor Mode, with the value Active
Teacher	Only on a record recognized from a Teacher source, with the value Yes
Attacker IP	The source address; it carries the Actions menu as in Summary
Attack Network	The network block the address belongs to (e.g. 34.80.0.0/12)
Ip Provider	The organization that operates the network block (e.g. Google LLC)
Attacker Location	The city and country of the address; the local network information for an address coming from the local network
Attacker User-Agent	The browser, device type and operating system of the client; the raw User-Agent value if it cannot be parsed

The last five fields are shown in a separate color because they describe the client.

• Query, HTTP Headers and Body are hidden by default; they are opened with the eye icon in their titles. The Matching Path Rules, Query, HTTP Headers and Body rows that carry no value are not listed at all.
• If Detailed log disabled is written in the Description row instead of the match, the detailed log is off in the check field in which the attack was caught (What does the "Detailed Log" option do; is a log written if I turn it off?).
• The Learning Suggestion row reports beforehand what the teaching operation will do; if no change remains to be made, the teaching button is disabled.

Operations

• Teaching a false positive: How do I allow a request that was blocked by mistake?
• Editing the rule from the log: How do I edit the matching rule from a log with "Edit Corresponding Rule"?
• Adding the attacker address to the blacklist: Can I blacklist an attacker IP directly from Event Logs (Attacker IP → Actions)?

Common Misconceptions

• "Body is present in every record." The body is written only if its size does not exceed the Max. Body Size to Log(kB) value and it has not been truncated for the inspection.
• "The teaching button on the Attacks tab teaches the whole record." Allow / Teach in the detail block teaches only the selected attack; the whole record is taught with the button in the title.
• "The classifications on the Summary tab belong to the selected attack." Summary summarizes all the attacks of the record; the classifications of the selected attack are on the Attacks tab.

How it is done in the documentation

• Event Logs · Preview of the Selected Log
• Event Logs · Summary Tab
• Event Logs · Attacks Tab
• Event Logs · Request & Location Tab

Related questions

• What does the "Detailed Log" option do; is a log written if I turn it off?
• How do I allow a request that was blocked by mistake?
• Is the request body written to the log?