This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

false positive

Hi,

One of our web servers time to time throw a false positive  from my own IP address when try to open a website, but the log dont shows any rule ID number, any idea how to correct this?

log says:

2018:09:05-09:41:26 securitysrv1-2 httpd: id="0299" srcip="217.XX.XX.30" localip="62.XX.XX.184" size="239" user="-" host="217.XX.XX.30" method="GET" statuscode="403" reason="waf" extra="Inbound Anomaly Score Exceeded (Total Score: 5, SQLi=1, XSS=): Last Matched Message: SQL Comment Sequence Detected." exceptions="-" time="3749" url="/scripts/jquery.condense.min.js" server="mysite.net" port="80" query="" referer="http://www.mysite.nl/" cookie=".ASPXANONYMOUS=34HorHIuekM21Xvf5xdL9sW-vi5v9ZpJ--rrB-sKsK2movgfh-tTE0Mvp3R4XQhiqg0Wn_lp6goMk5a-oac9FDbh21Nvd44FpiFABg03d3Q71WUfm0I_ZppghMz4LXNsv0wXIlCQ-TUEHGo1QHqOdQ2; ASP.NET_SessionId=o0hkulfuz4uqcpb5vt1j0szh" set-cookie="-" uid="W4@Ipj7dx7gAAB3OhUQAAAFl"

 

Thanks



This thread was automatically locked due to age.
Parents Reply Children
No Data