Firewall Rule - Match Triggered

[servicedesk3]

Hi All,

I’m having some difficulties in discovery what firewall rule have been used in “Firewall Event Log”.
Someone please can help me to understand how can I find the rule used in “match triggered” section? Actually I can see only this filter: 0df84ba4bb6a4515ae2210dccb06a02f

Thanks in advance

[sdayman]

As shown in the “Type” field, it says Firewall Rule, so that’s one of the rules you set up.

[servicedesk3]

Thanks for replying sdayman.

If I understood well, if another Firewall Rule was triggered (EG: URI Path), the event details will show “URI Path” instead “User Agent”?

I’m asking it because until now, I didn’t see any log different from “User Agent”.

Here’s all my rules…

[sdayman]

That’s where it gets confusing. When I look through my Firewall Events Log, I can tell which of my rules they violated.

But it does list the Filter used…though I can’t get the Rule ID from the Dashboard. Maybe the API can get you a list of your Firewall Rules along with their Rule ID.

[cs-cf]

Looking at the screenshots alone I assume it was “NotGETPOST” based on the description and the event details.

[sdayman]

Totally missed that. I read the rule as NoGetPost (which should have triggered alarm bells in my head).