← Alert queue
SL-1008lowWeb attack · Beginner · raised Oct 23, 13:07

WAF: SQL injection rule triggered (942100)

The web firewall (WAF) blocked several requests to the customer portal that contain database commands. This is called SQL injection: an attacker types database code into a website hoping it will hand over data.

Your task: Decide if this is a real attack and whether the portal needs any action. Check whether the firewall blocked it and what the server answered.

Assign this alert to yourself to see the evidence and start investigating.

Found something confusing or unrealistic?