Hi @hkohn
I’ve checked around, even FortiWeb has case/incident id
I still believe still should be a de-facto standard, very difficult to fine-tune environment which has no dedicated syslog
The blocked user (end-user/website user) can’t keep track since there’s no reference number…it’s not user 'friendly as per say…