Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Fortiweb:Parameter mensaje in log-attack-attack-view



We have a block in the Fortiweb Log see 7.25 in the attacks section, which although we put an exception in the signature with Regular Expression, it does not make it exceptional and causes us a "false positive"

The blocking occurs in a "parameter" that the Web does not have and is called "message", in which, if different "parameters" of the web are seen, it is like the "message" parameter is generated by the WAF in the Log and although in the exception of the signature, we refer to this parameter called "message", it cannot be exceptionalized, although within the "message" parameter, there are the parameters that carry the values ​​of the lock.


Parámetro: mensaje

Mached Pattern: 0000000000000077




Ejemplo Excepción de la firma: 090410001


Element Type:                                    Parameter

Operation:                                           Regular Expression Match

Name:                                                 mensaje

Check Value of Specified Element    True

Value:                                                  0*(\d)                                     

Concatenate                                        OR





Can you try disabling or add an exception for this signature directly from the log.





New Contributor

Thank you very much for your response Anignan,

It is a good answer and has given us the basis for a future "solution", because clicking on the context menu in the Attack Log, as you say, will result in an exception in the signature and will tell us how to address these blockages that We "still" do not know how to exceptionalize so that there are no "false positive" blocks. The problem is that we are consultants and not administrators, we have to tell the FortiWeb "administrator" how to bypass the blocking with "regular expressions" and that is the problem.

We are going to ask for it in the way you indicate and it will be reflected in the signature exception and I will comment on it in this thread.

Thank you so much


Top Kudoed Authors