How do I find a specific request by its Request Unique ID?

Short answer

Request Unique ID is the request ID that is shown as Request ID on the default blocking page (written to the page with the %UID variable) and sent with the uid key in the attack information that goes to the SIEM. On the vService's Event Logs screen, the server filter tab at the beginning of the filter strip is opened, the ID is pasted into the Request Unique ID field, Date Range is set so as to cover the date of the request, and Save & Get Logs is clicked. If the vService is not known, the same field is used on the Global WAF Event Log screen and all WAF-protected vServices are scanned. The search runs on the server side; there is no ID field in the filter strip and in the Log Filter fields. If the record is outside the selected date range, it is not found; if there is no record at all, the request may have been met with a result that is not written to Event Logs (a scan timeout, Learning mode or a clean request that stays below the threshold).

Problem: Only the ID of the Request Is at Hand

When WAF blocks a request, the user sees the blocking page; on the default page, the ID of the request is written in the Request ID row (Which Smart Variables can I use on the blocking page (%UID, %SRCIP, %WAFSCORE, %WAFINFO …); is it safe to show attack details?). When the user or the application team passes on this ID, the record of that request needs to be found among thousands of records and the reason it was blocked needs to be seen.

Solution: Three Methods

Your situation	Suitable method
The vService the request came to is known	Method 1: Event Logs
The vService is not known	Method 2: Global WAF Event Log
The record is also kept in the SIEM	Method 3: Searching by uid in the SIEM

Method 1: Event Logs Recommended

• How it works The ID is written to the server filter; the server pulls only the record that carries this ID.
• Where it is openedLeft Monitor Panel → WAF-Protected vServices → vService → Event Logs → the server filter tab at the beginning of the filter strip
• Requirement WAF permission
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Event Logs screen

In the Left Monitor Panel, the vService is clicked in the WAF-Protected vServices category and the Event Logs tab is selected (accessing Event Logs).

2

Adım 2 Open the server filter tab

The fixed tab at the beginning of the filter strip is clicked; the selected time range is written in its title (e.g. Last 7 day(s)).

3

Adım 3 Enter the ID

The ID is pasted into the Request Unique ID field (while the field is empty, All requests is written in it and all requests are listed).

4

Adım 4 Check the date range

If the date of the request is not within Date Range, the range is widened (default the last 7 days).

5

Adım 5 Save and list

Save & Get Logs is clicked.

Verification

1RecordTR7 side

A single record remains in the list; when the record is clicked, the same ID appears below the decision in the preview title.

ExpectedID in the title = ID searched for

The Request Unique ID summary chip appears below the strip; the ID filter is removed by closing the chip. In a cluster setup, whichever of the two devices the record came from, that device is written in the Source column.

Method 2: Global WAF Event Log

• How it worksGlobal WAF Event Log makes the same ID search in the records of all WAF-protected vServices.
• Where it is openedWAF → Global WAF Event Log
• Requirement WAF permission; an account whose permission is not restricted to specific vServices
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the screen

The WAF → Global WAF Event Log steps are followed.

2

Adım 2 Open the server filter tab

The fixed tab at the beginning of the filter strip is clicked.

3

Adım 3 Enter the ID and the range

The ID is pasted into the Request Unique ID field; Date Range is selected with the narrowest range that covers the date of the request.

4

Adım 4 Save and list

Save & Get Logs is clicked. If the Results are complete back to … warning appears above the list, the scan could not reach the whole of the range; the range is narrowed and the search is run again (the working of the scan).

Verification

1RecordTR7 side

The vService column of the record is examined; when the vService name is clicked, the WAF screen of that vService opens.

ExpectedA single record and the vService the request came to

Method 3: Searching by uid in the SIEM

• How it works In the requests in which an attack is found, the attack information sent by the log profile carries the same ID in the uid key; the record is searched in the SIEM with this key.
• Where it is opened The SIEM search screen
• Requirement A log profile on the vService that carries the attack information (CEF Format, TR7 JSON Format or TR7 WAF Log) (How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?)
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Search in the SIEM

In the SIEM, the uid field of the attack information is searched with the ID (uid structure). When the record is found, for the detail in TR7, the ID is searched in Event Logs as in Method 1.

Verification

1SIEM recordSIEM side

The attack information in the found row is examined.

Expected"uid":"AC10652A:D7236AA19B66:240002D", "action":"block"

In Blocking mode, the attack information of a request that is blocked because its scan could not be completed within the time limit does not contain the uid key.

Common Mistakes

• Writing the ID in the search box of the table. The Search box on the toolbar works only on the fetched rows; the ID is written in the Request Unique ID field in the server filter.
• Overlooking the date range. If the record stays outside Date Range, it is not found; on the vService screen, the default range is the last 7 days.
• Searching for a request that has no record at all. No Event Logs record is written for the requests whose scan times out, that fall into a host group in Learning mode, or that stay below the threshold in the Monitor state without triggering a signature (Why does a request that received 418 not appear in Event Logs?).
• Forgetting that the ID filter is on. As long as the field stays filled, the screen pulls only that record; all records are returned to by closing the summary chip below the strip, or by emptying the field and clicking Save & Get Logs.

How it is done in the documentation

• Event Logs · Request Unique ID
• Global WAF Event Log · What Is It For?
• TR7 WAF Log · The uid Structure

Related questions

• Which Smart Variables can I use on the blocking page (%UID, %SRCIP, %WAFSCORE, %WAFINFO …); is it safe to show attack details?
• Why does a request that received 418 not appear in Event Logs?
• Can I see the WAF logs of all vServices on one screen (Global WAF Event Log)?