Fix WAF False Positives with Learn Request | Demo

Shay_Levin — Tue, 29 Sep 2026 11:35:50 GMT

Legitimate request blocked by CloudGuard WAF? See how Learn Request resolves a false positive. In this demo, a bookstore search for “The Girl Who Played with UNION SELECT” is blocked.

We find the event in the Infinity Portal, mark it as benign, retry the search successfully, and then revert the learned status.

Learn Request vs. Exception:

• Learn Request: Mark an event as benign so the WAF learns its request pattern. Allow up to 2 hours for the change to reach enforcing agents. A revert can take the same amount of time.
• Exception: Define a policy rule with the conditions and action you choose. It takes effect on the next policy update.

Need the request unblocked right away? Use an Exception. Want the WAF to learn a confirmed false positive? Use Learn Request.

📄 Check Point documentation: https://waf-doc.inext.checkpoint.com/how-to/mark-a-log-as-benign

topic Fix WAF False Positives with Learn Request | Demo in WAF

Fix WAF False Positives with Learn Request | Demo