Which Event Logs columns are hidden by default; how do I show them?

Short answer

The Event Logs table opens with seven columns: Date, Action, Client IP, Method, Path, Attacks, User Agent. Six columns are hidden by default: Severity (the level of the highest attack score in the record), Host, Category, Scopes (the request sections in which the attacks were caught), ASN Org (the network block is displayed when hovered over) and X-Forwarded-For. If cluster is enabled, there is the Source column at the beginning of the table that shows the device the record came from, and on Global WAF Event Log there is the vService column. Hidden columns are shown by being checked on the Columns panel that opens with the gear icon at the beginning of the toolbar; on the same panel the columns are reordered by dragging and aligned, the height of the table is adjusted to the number of rows that fit on the screen with Fit rows to the page, and the layout returns to the default with Reset. The layout is stored per user; it is kept separately for the vService screen and the global screen.

Problem: The Information Sought Does Not Appear in the Table

To read from the table which domain name the records came to, in which part of the request the attack was caught or from the network of which organization the client came, the related columns must be shown. These columns are hidden by default so as not to crowd the table.

Solution

Columns Panel

• How it works The Columns panel determines which columns the table shows, in which order and with which alignment; the selection is applied immediately and stored per user.
• Where it is openedEvent Logs or Global WAF Event Log → the gear icon at the beginning of the toolbar → Columns panel
• Requirement WAF permission
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Event Logs screen

In the Left Monitor Panel, the vService is clicked in the WAF-Protected vServices category and the Event Logs tab is selected (accessing Event Logs).

2

Adım 2 Open the Columns panel

The gear icon at the beginning of the toolbar is clicked; the Columns panel opens and the columns are listed with checkboxes.

3

Adım 3 Check the columns

The columns to be shown are checked:

Hidden column	What it shows
Severity	The level of the highest single attack score among the attacks in the record (not the total score of the request), in the color of the level: 50 and above Blacklist, 10 and above Structural, 8 and above Very High, 6 and above High, 4 and above Medium, 2 and above Low, below that Very Low (Severity values)
Host	The Host header of the request
Category	The attack categories of the triggered signatures
Scopes	The request sections in which the attacks were caught: Path, Query, Header, JSON, Xml, Form, Raw
ASN Org	The organization that operates the autonomous system the client address belongs to; the network block is displayed when hovered over
X-Forwarded-For	The addresses in the X-Forwarded-For header of the request; if there is no header, -

4

Adım 4 Adjust the layout (if needed)

On the same panel, the columns are reordered by dragging and an alignment is selected per column; Fit rows to the page adjusts the height of the table to the number of rows that fit on the screen, and Reset returns the column layout to the default. The changes are stored without a separate save step.

Verification

1TableTR7 side

The table header is examined; when the screen is opened again, it is seen that the layout is preserved.

ExpectedThe checked columns appear in the table

Conditional Columns and Filter Tabs

• Source: It is located at the beginning of the table only while cluster is enabled and shows the name of the device the record came from (In a cluster, which device do WAF logs come from; how do I distinguish the device in Event Logs?).
• vService: It is present only on Global WAF Event Log; when the name is clicked, the WAF screen of that vService opens.
• Two tabs on the filter strip are also hidden by default: User Agent and Protocol. They are added with the + button at the end of the strip (filterable information).
• When a column header is clicked, first a descending and then an ascending sort is applied, and on the third click the sort is removed; the Attacks column is sorted by the number of attacks that are still open.

Common Mistakes

• Thinking that the layout on the global screen also carries over to the vService screen. The column layout, the filter tabs and the server filter are stored separately for the two screens.
• Thinking that hidden columns come automatically in the export. The Columns list in the Export Table window comes filled with the visible columns; hidden columns are checked there separately (Can I export Event Logs as Excel, CSV or PDF?).
• Thinking that the X-Forwarded-For column is the client address. If Trusted Proxy is defined, the real client address is already in the Client IP column; X-Forwarded-For shows the chain in the header.

How it is done in the documentation

• Event Logs · The Logs Listing Screen
• Event Logs · Columns
• Event Logs · The Filterable Information

Related questions

• In a cluster, which device do WAF logs come from; how do I distinguish the device in Event Logs?
• Can I export Event Logs as Excel, CSV or PDF?