An attack is the record on Attacks in WMC and in /attacks/v1/get_attacks. An event under System → Logs is a message about the agent itself. The two names are separated in the Glossary.
Note the host, the path, the signature and the blocking type.
| Blocking type | What blocked it | Next page |
|---|---|---|
1 |
A signature whose score is not 12. The Filter log shows CRL ID in the matched zone |
False positive handling when the request is legitimate |
2 |
A signature with score 12, or a request processing rule |
The same page. The test signature /mikiri-waf-test is score 12 |
3 |
MLA | How ML detection works |
7, 8, 9, 10 |
MLC: brute-force, flood, or DDoS | Activating AI protection |
14 |
The request does not match the OpenAPI specification | API Firewall settings |
17 |
A signature or a response rule on the upstream response | Response analysis |
The full list of types is Request processing statuses.
A test request /mikiri-waf-test with signature ID 1 in PATH is the check that blocking works. Leave that block in place.
A legitimate request needs the narrowest exclusion that still lets the test signature through. The scopes are in False positive handling. Send the legitimate request again, then send /mikiri-waf-test. The application answers the first. Filter answers 403 to the second.
A vulnerability that Scanner confirmed is closed with a request rule, then checked again. That sequence is Discover, verify and mitigate.