Is the attack payload sent to the SIEM (Same as 'detailed log' / Always Send / Never Send)?

Short answer

The sending is determined by the Attack Payload in WAF Info setting on the SIEM & Attack Details card; the payload is sent in the payload key of every attack record, with the matching content and a short context around it. Same as 'detailed log' (default): if Detailed Log is on in the inspection field where the attack was caught, the matching content is sent; if it is off, the payload key is not written on a signature hit. Always Send: the matching content is meant to be sent independently of the Detailed Log setting; however, this option cannot produce content in an inspection field where Detailed Log is off, and the scan of that request is left incomplete, so while Always Send is selected, Detailed Log is kept on in the inspection fields. Never Send: the payload is never written. The descriptions of structural inspection and blacklist hits are always sent with the options other than Never Send. Since the payload carries the actual attack string in the request, the channel to the SIEM and the access in the SIEM are protected accordingly.

Options

Option	In a field where Detailed Log is on	In a field where Detailed Log is off	Card sentence
Same as 'detailed log' (default)	The matching content and its context	No payload	The attack payload is sent in sync with the detailed-log setting
Always Send	The matching content and its context	Content cannot be produced, the scan is left incomplete (the warning below)	The attack payload is always sent
Never Send	No payload	No payload	The attack payload is never sent

Always Send and Detailed Log

While Always Send is selected, if a signature matches in an inspection field where Detailed Log is off, the content cannot be extracted and the scan of the request is left incomplete; if Block Unexpected Parser Errors is on, such a request is blocked. If the content is to be sent in every field, the Detailed Log setting of the inspection fields is turned on; otherwise, Same as 'detailed log' is used (Edit warning).

• The payload is only one field of the attack information; for it to reach the SIEM, a log profile that carries the attack information (CEF Format, TR7 JSON Format, TR7 WAF Log or a Manual format that uses %WAFINFO) must be assigned to the vService (How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?).
• The Description line in Event Logs comes from the same source: in a field where Detailed Log is off, it shows Detailed log disabled (What does the "Detailed Log" option do; is a log written if I turn it off?).
• In Blocking mode, for a request that is blocked because its scan could not be completed within the time limit, the attack record does not carry a payload.

Configuring in TR7

On the WAF Management tab, the pencil icon of the SIEM & Attack Details card is clicked; Attack Payload in WAF Info is selected and Edit is clicked (SIEM & Attack Details Edit screen). There is no separate deployment step; the setting applies across the vService.

In WEB-CLI, the setting is the --wafInfoPayload field: 1 Always Send, 0 Never Send; when the field is left empty (undefined), Same as 'detailed log' applies (WAF info content).

Common Misconceptions

• "Never Send also sends the description." While Never Send is selected, the payload key is never written; the rule description is not sent either.
• "Always Send makes Detailed Log unnecessary." In fields where Detailed Log is off, content cannot be produced; Detailed Log is turned on in these fields.
• "The payload is the whole body of the request." The payload is the matching slice and a short context around it; the attack information does not carry the body of the request (Is the request body written to the log?).

How it is done in the documentation

• SIEM & Attack Details · Attack Payload in WAF Info
• SIEM & Attack Details · Edit
• WEB-CLI · waf options · The WAF Info Content

Related questions

• What does the "Detailed Log" option do; is a log written if I turn it off?
• Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?
• How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?