Skip to main content

Security Event

When a rule is triggered, a security event is generated by the RASP Java Agent and sent to the Portal for visibility and investigation.

Security events provide key runtime details such as:

  • Date and time
  • Application and agent
  • Mod and rule name
  • Rule type and severity
  • Trigger details

These details help you monitor rule activity and investigate potential attacks using the Events and Advanced Search pages in the Portal.

Message​

In the Security events section of the Rules Wizard, a custom message can be provided for the security event in the Message (optional) field. This value is included, as one of the extension fields, in the generated event, making it easier to identify and filter specific rule triggers. If left blank, a default message is used.

Severity​

In the Security events section of the Rules Wizard, you can assign a custom severity level to the event using the Severity dropdown: Low, Medium, High or Critical. If no severity level is selected, one is set automatically and shown in the dropdown with (Auto): Medium for the Detect action, High for the Protect action, and Low for any other action.

The Disable security events option is available in the Security events section of supported rules in the Rules Wizard. If this option is selected, no security event is created for that rule trigger, and the event will not appear in the Portal.

The Disable security events option will be disabled/greyed out when the rule action is set to Detect.