Manual Traffic Learning -> Malformed JSON Data: How to handle this?

Hello raischk, it may not be available for all violations but normally you can access violating payload in the event logs by : cliking on the violation name in the request event, it opens violation details then click in view details. this shows you for example when a signature match the payload concerned.

now for that type of encoding problem, not sure we can report precisely on it.

the policy building menue you quote is giving you the opportunity to deactivate this violation to let the traffic pass as it seems to be a false positive for you.