Imperva Cyber Community

 View Only

Incap rule catching Predated Events

By Varul Arora posted 08-28-2023 00:29


Sometimes, it's possible that when we create a rule on a site, for example at 14:00 SGT and the rule may catch and show the events from 12:00 SGT even before the rule was created. This behaviour is bit odd as the rule was catching the event which was created before the rule.  Please see the screenshot below

Please note that this is an expected behaviour of the WAF as the session from that particular IP is still active which is matching the rule syntax, hence, we can see the events generated from the rule even before the rule was created.