You are here

Event: Blocked Requests

Affects product: 
Airlock WAF
Affects version(s): 
all versions since 4.1

This event is generated when 5 or more requests were blocked within 2 minutes as a result of filter rules.

Possible reasons:

  • attack against applications (are all requests coming from the same IP address?)
  • missing exception configuration for parameters

Rating: You should analyze whether the blocked requests were in fact attacks, or inadvertently blocked legitimate requests. Example: a Webmail application can have SQL statements in the subject or body of the message - those parameters should be defined as exceptions.

Hint: Frequency and number of the log messages required for the event to be generated can be customized. Check the separate article about customizing events

Knowledge Base Categories: