Imperva Cyber Community

 View Only
  • 1.  Incident id N\A in the error logs

    Posted 5 days ago
    Hi Team,

     users complain the requested pages has been blocked and it only shows incident id N\A .  Need to know how to get the exact incident id instead of N\A

    #On-PremisesWAF(formerlySecuresphere)

    ------------------------------
    sameer Vidanage
    Lead Engineer
    Kelaniya
    ------------------------------


  • 2.  RE: Incident id N\A in the error logs

    Posted 5 days ago
    Hi @sameer Vidanage,

    There can be multiple reasons for that, it can be caused by new ciphers you've implemented recently or changed the mode from Bridge to NGRP, for example.
    But here's something that can help:

    Reverse Proxy (TRP/KRP): Can't find incident ID in the GUI or "The incident ID is: N/A"
    this article has the troubleshooting steps that can help find and fix the issue.
    Let me know if that helps,

    Ira



    ------------------------------
    Ira Miga
    Imperva
    Knowledge Engineer
    ------------------------------



  • 3.  RE: Incident id N\A in the error logs

    Posted 3 days ago
    Hi Ira,

    Thanks for kind attention. Even that solution  also results the different error response with no Incident id. My concern is if we know the exact incident id we can identify and troubleshoot the exact issue. F5 have this feature. Any suggestions would be appreciated?

    Regards,
    Sameera

    ------------------------------
    sameer Vidanage
    Lead Engineer
    Kelaniya
    ------------------------------



  • 4.  RE: Incident id N\A in the error logs

    Posted 3 days ago
    Hi sameer,

    If your problem is about getting unique event id of the violation you can use following variable in block page:

    The incident ID is: $(EVENT_ID).

    ------------------------------
    Cezmi Cal
    technical support engineer
    Barikat Cyber Security
    Ankara
    ------------------------------