> For the complete documentation index, see [llms.txt](https://waf-doc.inext.checkpoint.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://waf-doc.inext.checkpoint.com/how-to/mark-a-log-as-benign.md).

# Mark a Log as Benign

If Check Point WAF flags a legitimate request as an attack, you can mark that log as **benign**. The WAF then learns that the request is safe and stops blocking or flagging matching traffic — without reducing protection for genuinely malicious requests.

Use this to resolve a false positive on a specific request, instead of waiting for the WAF's automatic learning to adapt or writing a broad exception.

### Prerequisites

* The asset's WAF practice is set to **Detect** or **Prevent** mode.
* You have permissions to manage the asset's policy in the Infinity Portal.

### Steps

1. In the Infinity Portal, go to **Check Point WAF > Events** and filter to your asset.
2. Locate the log for the request you want to allow. Use the URL, parameter, and timestamp to confirm it is the legitimate request being flagged.
3. Open the log to review its details — matched indicators, location, and parameter.
4. Right-click the log and select **Mark as benign**.
5. Optionally, add a short reason or comment.
6. Confirm. The log is marked and its request pattern is recorded as benign.

Once the action is recorded, the log shows a **Learned** badge.

### When it takes effect

Allow up to **2 hours** for the change to reach the enforcing WAF agents.

To verify, re-send the request that was previously flagged and confirm it is no longer blocked (in Prevent mode) or no longer raised as an attack (in Detect mode).

#### If you need it resolved immediately

Marking a log as benign is the recommended way to clear a false positive, but it is not immediate. If the request must be unblocked right away, add an **Exception** for it instead.

| You want…                                                | Use                                                                       | Takes effect                           |
| -------------------------------------------------------- | ------------------------------------------------------------------------- | -------------------------------------- |
| The WAF to learn that this request is safe (recommended) | **Mark as benign**                                                        | Up to 2 hours                          |
| The request unblocked immediately                        | [**Exception**](/setup-instructions/setup-custom-rules-and-exceptions.md) | Immediately, on the next policy update |

### How to revert

If you marked the wrong log, or the request should be prevented again:

1. Open the same log it shows the **Learned** badge.
2. Right-click the log and select **Revert**.
3. Allow the same 2-hour propagation window.

After propagation, matching traffic is protected again.

{% hint style="info" %}

* Marking a log as benign applies to the specific request pattern derived from that log, not to a broad URL pattern. To allow a whole URL or parameter pattern, use an exception instead.
* If you are unsure whether a request is genuinely benign, investigate before marking it. Marking a real attack as benign reduces protection for that pattern.
* If the same request pattern keeps arriving at high volume from many sources, the WAF's automatic learning may re-learn it after you revert. If a reverted request keeps coming back, investigate the underlying traffic or open a case with Check Point Support.
  {% endhint %}

### Related

{% content-ref url="/pages/GNWpbCvPUpbndRI217p4" %}
[Setup Custom Rules and Exceptions](/setup-instructions/setup-custom-rules-and-exceptions.md)
{% endcontent-ref %}

{% content-ref url="/pages/hL9P2lcN6vILXJVps4bZ" %}
[Track Learning and Move from Learn/Detect to Prevent](/how-to/track-learning-and-move-from-learn-detect-to-prevent.md)
{% endcontent-ref %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://waf-doc.inext.checkpoint.com/how-to/mark-a-log-as-benign.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.