Difference between "Illegal" and "Blocked" request

'Illegal' in the ASM logs may also mean you have checked the

Alert

tickbox in policy Blocking Settings while the

Block

tickbox is unchecked. So the request is deemed illegal according to your policy configuration, but not subject to blocking (even when policy itself is in Blocking Status, you can have individual features as alert-only).

You may want to have such "alert-only" configuration for security-features you are planning to take into use, but want to first evaluate if those features align with your application without a negative consequence.

Regards,