Technical Tip: Known attack signature exception rule

For false positive blockings requiring exceptions for specific URLs or other supported parameters, verify the triggered signature details and validate whether the request is legitimate.

Note:

Msg ID observed in the client browser can be used to filter specific attack logs.

1. Navigate to Threat Analytics -> Attack Logs and selectthe  ‘>’ icon to open attack log details.

Validate whether the triggered signature is a false positive. A new window pops up when selecting the Signature ID number associated with the attack log and shows details of the triggered signature.

2. Select ‘Add Exception’ in the details pane.
3. Specify the exception method and select 'OK'.

The list of created exceptions will be updated in WAF -> Application -> Security Rules -> Known Attacks -> Signature Based Detection Exception Rule.

For more information about the signature exception rule and supported options, refer to the FortiAppSec Cloud User Guide:
Known Attacks