Skip to main content
Version: v7

Match Finder

Overview​

It Identifies, stores all the rules matched by WAF, and generates match finder details for a specific or all listener so that you can identify all matched, rules for the listener by listing the events.

matchfinder

How to Use:​

  1. Go to WAF > Tool > Match Finder
  2. Click on the Run Query button on the top right side.

Description​

Incident ID​

It displays the event ID logged for the certain request found to be malicious.

Matched Rule​

It displays all matched rule id for the query.

URI​

It displays the matching URI for the current event.

Zone​

It displays the zone/sub-domain name that belongs to it.

Payload​

It displays the payload matched for the current event.

Action​

It specifies the action to be taken. To whitelist current event rules, click on the Whitelist button. We can further download all events matched based on the filter from the event page.