In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?

Short answer

An Event Logs record is created only in Monitor and Blocking modes; in Learning Mode, the requests are written to the learning log and Event Logs stays empty, which does not mean that there is no attack. In Monitor and Blocking modes, a record is written in one of two cases: if the total score reached the blocking threshold or if a signature whose State value is Monitor matched. Requests that stay below the threshold and in which only Enabled signatures matched are not logged in any mode. Requests that come with the Conditional Learning identity are not logged in Blocking mode either; requests that are blocked in Blocking mode because their scan could not be completed within the 2-second time limit do not appear in Event Logs either; if Debug Mode is on, they appear in Debug Mode Logs.

Is a Record Created?

Situation	Learning mode	Monitor mode	Blocking mode
Score ≥ threshold	No	Yes · Not blocked — Monitor mode	Yes · Attack blocked
Score < threshold, a signature with State = Monitor matched	No	Yes · Not blocked — Monitor mode	Yes · Not blocked — Below the blocking threshold
Score < threshold, only Enabled signatures matched	No	No	No
Teacher identity; score ≥ threshold or a signature with State = Monitor matched	No	Yes · Not blocked — Teacher IP matched (Teacher cookie or Teacher header, depending on the identity)	Yes · Not blocked — Teacher IP matched (Teacher cookie or Teacher header, depending on the identity)
Conditional Learning identity	No	No	No
Static content within the scope of Do not WAF static contents, a request that matches the Whitelist Condition	No	No	No
Its scan cannot be completed within the 2-second time limit	No; the request is let through, except for one exception that can occur while the rules are being loaded	No; the request is let through, except for one exception that can occur while the rules are being loaded	No; the request is blocked (let through if Fail-open is on), and if Debug Mode is on, it appears in Debug Mode Logs as Attack blocked — scan timed out

The decisions in the table appear in the Action column of Event Logs and in its preview. In Monitor mode, a below-threshold match of a signature whose State = Monitor is also written as Not blocked — Monitor mode. These records are separated in Event Logs with the Monitor Only field of the Log Filter; in Debug Mode Logs, on the other hand, they appear as Not blocked — Below the blocking threshold.

• In a record, all the signatures that the request matched are listed. The request body is written to the record in full if its size fits within the Max. Body Size to Log(kB) value (default 2 kB); a body that exceeds this value is not added to the record at all.
• Records that match the WAF Log Suppression Condition are written but are not shown in the Event Logs list.
• In a cluster setup, each device keeps its own records; Event Logs shows the records of the two devices in a single list, and the device the record came from is written in the Source column.
• To see the matches below the threshold, the State value of the related signature is set to Monitor (How do I try a new signature in production without risk (Monitor state)?).
• The same cases in terms of whether the request is blocked or not: In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?

Common Misconceptions

• "If Event Logs is empty, there is no attack." Matches below the threshold and Learning Mode do not produce records; the traffic in Learning mode appears in the Learning series of the WAF Inspection Distribution panel on the Dashboard.
• "Below-threshold matches cannot be seen without lowering the threshold." If the State value of the related signature is set to Monitor, its below-threshold matches are also recorded; this signature is not added to the attack score.
• "Every blocked request appears in Event Logs." In Blocking mode, no record is written for a request that is blocked because its scan could not be completed within the time limit (Why does a request that received 418 not appear in Event Logs?).

How it is done in the documentation

• Event Logs · Under Which Condition Is the Log Produced?
• Event Logs · The Action Values
• Signature & Rule Library · State Values and Their Counterpart in the Traffic
• Log Settings · WAF Log Suppression Condition

Related questions

• In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?
• Which decisions does the WAF make for a request; what do Action in Event Logs and Verdict in Debug Mode Logs mean?
• What do the Action values in Event Logs mean?