There’s a unique identifier under the trackingReference that shows all the matches that have increased the anomaly score eventually causing it to be blocked. https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-troubleshoot#understanding-waf-logs More details on how.