Each row in the View Logs table represents one detected event. The columns are described below.
| Column | Description |
|---|---|
| IP | The IP address of the request. Displayed as a link; clicking it opens a whois lookup on whois.com in a new tab. If the IP address cannot be validated, it is displayed as plain text. |
| Time | The date and time the event was recorded, formatted according to the Joomla date format setting. |
| User | The Joomla username associated with the request, if the visitor was logged in. Shown as a dash when the request came from a guest. |
| Description | Three layers of information: (1) a human-readable event category translated from the tag description key; (2) the raw description string stored by the firewall; (3) an expandable Original String section showing the decoded base64 payload of the attack, truncated to 4,000 characters. |
| URI | The request URI, truncated to 70 characters. The full URI is shown as a tooltip when the cursor hovers over a truncated value. |
| Component | The Joomla component that was targeted, truncated to 40 characters. |
| Type | A coloured badge identifying the attack category. See Log Types for the full list. |
| Read/Unread | A green Read badge or a yellow Unread badge. New entries are always unread until marked. |
The Description column is the most information-dense column. It stacks three elements vertically:
<details> element that reveals the base64-decoded attack payload. The decoded string is rendered in a monospace font, wrapped, and limited to a scrollable box of 6 lines. Payloads exceeding 4,000 characters are truncated with an ellipsis.