Event: Blocked Requests

This event is generated when 5 or more requests were blocked within 2 minutes as a result of filter rules.

Possible reasons:

• attack against applications (are all requests coming from the same IP address?)
• missing exception configuration for parameters

Rating: You should analyze whether the blocked requests were in fact attacks, or inadvertently blocked legitimate requests. Example: a Webmail application can have SQL statements in the subject or body of the message - those parameters should be defined as exceptions.

Hint: Frequency and number of the log messages required for the event to be generated can be customized. Check the separate article about customizing events.