High-level WAF dashboard: total events, unique IPs, unique rules, events in last hour. Start here to assess if anything needs attention.

Top attacking IPs with hit counts, geo info, and last seen timestamp. Use to identify most active sources.

Most frequently triggered WAF rules with severity and description. Use to identify dominant attack patterns.

Rules that triggered on HTTP 2xx responses — likely false positives. Critical for WAF tuning.

Drill into events from a specific IP address. Shows timestamps, methods, URIs, HTTP codes, and triggered rules.

Drill into events that triggered a specific rule. Shows timestamps, IPs, methods, URIs, HTTP codes, and matched data.

Full deep-dive into a single event by index. Shows all request headers, body snippet, all rule matches with matched data, and response code.

Get WAF container health, engine mode, rules loaded, and paranoia level.

Change WAF engine mode: On (actively blocking), Off (disabled), or DetectionOnly (log without blocking).

Set CRS paranoia level (1-4). Level 1 is minimal rules, level 4 is maximum security with more false positives.

Disable a specific ModSecurity rule by ID to suppress false positives.

Re-enable a previously disabled ModSecurity rule by ID.

Whitelist an IP address to bypass WAF inspection entirely.

Remove an IP address from the WAF whitelist.

Run the WAF test suite to verify blocking and pass-through rules are working correctly.