Security events

Security events explain why Easel allowed, blocked, logged, or challenged a request.

For the full security product model, see Firewall observability.

Where security shows up

• Request detail Firewall badge on Logs
• Project overview firewall action snapshots
• Observability charts that group by firewall action when the field is present
• Response headers such as X-Easel-Firewall-Action and X-Easel-Firewall-Rule-Id on some denials

Actions

Customer-facing action values you may see include:

deny
challenge
challenge_pass
challenge_fail
redirect
log
bypass

Platform protections may also surface actions such as ban or throttle.

Decision sources

Prefer product concepts when describing a decision:

• Platform protection
• Custom rule
• Attack Mode
• Deployment protection

See Attack Mode and Custom firewall rules.

Debugging workflow

1. Reproduce the request and capture the request ID.
2. Open Logs for that ID or time window.
3. Check the Firewall badge and status code.
4. Confirm rule configuration in Project settings → Custom WAF rules.
5. Confirm whether Attack Mode or deployment protection is enabled.

When a challenge interstitial appears, verification outcomes may show as challenge pass or fail around /.well-known/easel-challenge/verify.

Related guides

• Firewall observability
• Security troubleshooting
• Request details