> For the complete documentation index, see [llms.txt](https://waf-doc.inext.checkpoint.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://waf-doc.inext.checkpoint.com/how-to/mark-a-log-as-benign.md).

# Mark a Log as Benign

If Check Point WAF flags a legitimate request as an attack, you can mark that log as **benign**. The WAF then learns that the request is safe and stops blocking or flagging matching traffic — without reducing protection for genuinely malicious requests.

Use this to resolve a false positive on a specific request, instead of waiting for the WAF's automatic learning to adapt or writing a broad exception.

### Prerequisites

* The asset's WAF practice is set to **Detect** or **Prevent** mode.
* You have permissions to manage the asset's policy in the Infinity Portal.

### Steps

1. In the Infinity Portal, go to **Check Point WAF > Events** and filter to your asset.
2. Locate the log for the request you want to allow. Use the URL, parameter, and timestamp to confirm it is the legitimate request being flagged.
3. Open the log to review its details — matched indicators, location, and parameter.
4. Right-click the log and select **Mark as benign**.
5. Optionally, add a short reason or comment.
6. Confirm. The log is marked and its request pattern is recorded as benign.

Once the action is recorded, the log shows a **Learned** badge.

### When it takes effect

Allow up to **2 hours** for the change to reach the enforcing WAF agents.

To verify, re-send the request that was previously flagged and confirm it is no longer blocked (in Prevent mode) or no longer raised as an attack (in Detect mode).

#### If you need it resolved immediately

Marking a log as benign is the recommended way to clear a false positive, but it is not immediate. If the request must be unblocked right away, add an **Exception** for it instead.

| You want…                                                | Use                                                                       | Takes effect                           |
| -------------------------------------------------------- | ------------------------------------------------------------------------- | -------------------------------------- |
| The WAF to learn that this request is safe (recommended) | **Mark as benign**                                                        | Up to 2 hours                          |
| The request unblocked immediately                        | [**Exception**](/setup-instructions/setup-custom-rules-and-exceptions.md) | Immediately, on the next policy update |

### How to revert

If you marked the wrong log, or the request should be prevented again:

1. Open the same log it shows the **Learned** badge.
2. Right-click the log and select **Revert**.
3. Allow the same 2-hour propagation window.

After propagation, matching traffic is protected again.

{% hint style="info" %}

* Marking a log as benign applies to the specific request pattern derived from that log, not to a broad URL pattern. To allow a whole URL or parameter pattern, use an exception instead.
* If you are unsure whether a request is genuinely benign, investigate before marking it. Marking a real attack as benign reduces protection for that pattern.
* If the same request pattern keeps arriving at high volume from many sources, the WAF's automatic learning may re-learn it after you revert. If a reverted request keeps coming back, investigate the underlying traffic or open a case with Check Point Support.
  {% endhint %}

### Related

{% content-ref url="/pages/GNWpbCvPUpbndRI217p4" %}
[Setup Custom Rules and Exceptions](/setup-instructions/setup-custom-rules-and-exceptions.md)
{% endcontent-ref %}

{% content-ref url="/pages/hL9P2lcN6vILXJVps4bZ" %}
[Track Learning and Move from Learn/Detect to Prevent](/how-to/track-learning-and-move-from-learn-detect-to-prevent.md)
{% endcontent-ref %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://waf-doc.inext.checkpoint.com/how-to/mark-a-log-as-benign.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.