WAF request logs

WAF request logs capture HTTP requests blocked by your Web Application Firewall rules. Use these logs to investigate security events, identify attack patterns, and validate WAF configuration.

Because only blocked requests are shown, this view helps you focus on potentially malicious traffic.

Tag badges are color-coded by WAF signal category.

For WAF defaults and tuning, see Web Application Firewall (WAF) in DX Cloud Operations.

Key information tracked

• Request details: HTTP method, protocol, host, path, query parameters, client IP
• Response status: HTTP status code for the blocked request
• Security metadata: WAF agent code, zone, and classification tags
• Client context: user agent string

Select desired cluster

Select your desired cluster from the dropdown menu at the top of the Cockpit.

View WAF request logs

From Logs > WAF requests:

1. Select your desired cluster.
2. View the chart to see blocked request activity over time.
3. In Filters, set date range, request details (method, protocol, hosts, IPs, paths, query parameters), response codes, security context (zones, tags), performance/size thresholds, user agent, and search terms.
4. Click Apply filters.

When you Apply filters, the selection persists: if you reload the page, you see the same filter selection.

It also ensures you can share the selection and the recipient sees the same view as you do.

Example

https://cockpit.magnolia-platform.com/logs/events?from=2026-03-06T16:25:31.842Z&to=2026-03-06T17:25:31.842Z&

In this case, the URL shows event logs for the last hour on the selected date.

Details table