Detail of AWS WAF - Web Exploits Rules by F5's Rule

When we upload the Excel file, it is blocked by Web Exploits Rules by F5's Rule.

please see below WAFlog.

-----------------------------------------------------------------------

{"timestamp":1637571625959,

"formatVersion":1,

"webaclId":"9e22227d-1fba-4844-a34b-43d35b20b2ae",

"terminatingRuleId":"8b270c08-5d30-4940-a5bb-02e74c11b38f",

"terminatingRuleType":"GROUP",

"action":"BLOCK",

"terminatingRuleMatchDetails":[],

"httpSourceName":"ALB",

"httpSourceId":"XXXXXXXXX-app/XXXXXXXXServer/XXXXXXXXXXXXXXXXXXX",

"ruleGroupList":[{"ruleGroupId":"8b270c08-5d30-4940-a5bb-02e74c11b38f",

"terminatingRule":{"ruleId":"c0ae2d87-48f1-4813-9e91-3e723f8d7b36",

"action":"BLOCK",

"ruleMatchDetails":null},

"nonTerminatingMatchingRules":[],

"excludedRules":null}],

"rateBasedRuleList":[],

"nonTerminatingMatchingRules":[],

"requestHeadersInserted":null,

"responseCodeSent":null,

"httpRequest":{"clientIp":"XX.XXX.XX.XXX",

"country":"JP",

"headers":[{"name":"host",

"value":"xxxxxxxxxxxxxxxxxxxx.com"},

{"name":"content-length",

"value":"512302"},

{"name":"sec-ch-ua",

"value":"\"Google Chrome\";v=\"95\", \"Chromium\";v=\"95\", \";Not A Brand\";v=\"99\""},

{"name":"accept",

"value":"application/json, text/javascript, */*; q=0.01"},

{"name":"content-type",

"value":"multipart/form-data; boundary=----WebKitFormBoundaryN8QBl8AUNfmYGqws"},

{"name":"x-requested-with",

"value":"XMLHttpRequest"},

{"name":"sec-ch-ua-mobile",

"value":"?0"},

{"name":"user-agent",

"value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"},

{"name":"sec-ch-ua-platform",

"value":"\"Windows\""},

{"name":"origin",

"value":"https://xxxxxxxxxxxxxxxxxxxxxxxxx.com "},

{"name":"sec-fetch-site",

"value":"same-origin"},

{"name":"sec-fetch-mode",

"value":"cors"},

{"name":"sec-fetch-dest",

"value":"empty"},

{"name":"referer",

"value":"https://xxxxxxxxxxxxxxxxxxxxx.com/xxxxx/xxxxxxx/xxxxxxxxx/xxxx"},

{"name":"accept-encoding ",

"value":"gzip, deflate, br"},

{"name":"accept-language",

"value":"ja,en-US;q=0.9,en;q=0.8"},

{"name":"cookie",

"value":"JSESSIONID=04DE9DEA76FDF48733FE23D7F5029B43; MP_PORTAL_SID=xxxxxxxxxxxxxxx; AWSALBTG=xxxxxx/xxxxxxxx; AWSALBTGCORS=xxxxxxxxx"}],

"uri":"/xxxxxxxxxx/xxxxxxxxxx/xxxxxxxxxxxxxx/xxxxxxxx",

"args":"",

"httpVersion":"HTTP/2.0",

"httpMethod":"POST",

"requestId":"1-619b5c29-13a199306dd99bbd6753a9c9"}}

-----------------------------------------------------------------------

then, When we add "ruleId":"c0ae2d87-48f1-4813-9e91-3e723f8d7b36" to WAF as White list, 

Excel file is not blocked & uploaded successfully.

so, We assume that it blocks Excel file.

what is the "ruleId":"c0ae2d87-48f1-4813-9e91-3e723f8d7b36" ?

Cloud you let us know the detail of this ruleId?

Can we know what is wrong of Excle file?

thanks.