Log mode is a detection setting in which a security rule records traffic that matches its conditions but does not automatically block it. In a web application firewall (WAF), a match may appear in security logs for review while the request continues to the application.
This mode helps teams assess a rule’s impact before enforcing it, especially when legitimate requests may match broad indicators such as a URL path or a request header. During an attack investigation, logged matches provide useful telemetry, but they do not prove that a request was malicious or that an exploit succeeded. Defenders should review events alongside application logs and confirm the rule’s effective action; log mode is not a substitute for patching vulnerable software or enabling blocking when appropriate.