Imperva Cyber Community

Sometimes, it's possible that when we create a rule on a site, for example at 14:00 SGT and the rule may catch and show the events from 12:00 SGT even before the rule was created. This behaviour is bit odd as the rule was catching the event which was created before the rule.  Please see the screenshot below

Please note that this is an expected behaviour of the WAF as the session from that particular IP is still active which is matching the rule syntax, hence, we can see the events generated from the rule even before the rule was created.