Firewall event activity log not displaying

Hey team,

As of late we have been unable to view actual events from the Firewall overview page.
Every week we do a pass of blocked/logged events to help us tune our WAF in case of ruleset changes which we need to adopt or remove. I filter firewall events by WAF type but am often unable to view actual event activity (see example screenshot, plenty of events for a given domain but no/limited results in the activity log).

(Note 1-1 of 17 items)

We have a work around by correlating events via Splunk through LogPull but it’d be nice to be able to view this all in the dashboard. This had been working fine up until a couple months ago…

Hi @squip,

That is odd. I seem to be getting some strange behaviour on mine as well, I don’t check it regularly so I can’t confirm if it is a long-term issue for me.

I see this on my Business plan:

On my Enterprise plan, the first two pages show normally but beyond that they don’t display either:

I’ll drop this into our Community escalations queue, however you should get a much faster response through a ticket, as you’re on Enterprise. If you do have/create a ticket, please let us know the number here so it can be tied to the escalation.

Thanks @domjh - Yep I’m on Enterprise for several domains. I was considering raising it with my account manager to pass onto the respective team.

1 Like

Is this still not working for you? I just checked my ENT logs and they look normal to me. Biz plan also looks ok. Below is my Ent plan log:

I see plenty of FW events - But I’m filtering down to WAF events for a 72Hr period and I hardly ever get the result-set I should.

I can confirm it’s happening to me too.