What is the event triggered by Armor and the FieldType indicates it?

[cleonchen]

I would like to ask what the meanings of each record field of matchedFieldType in logs when the following recording function is enabled in the armor document?
https://cloud.google.com/armor/docs/request-logging#verbose-values

Like : 

What exactly is this in the trigger rule?
owasp-crs-v030301-id921150-protocolattack

matchedFieldType: "ARG_NAMES" > What does this value represent?
matchedFieldValue: " " > means there is a space in the payload?

[VannGuce]

These values are the source of traffic going to google load balancer or cloud armor, there is no specific definition of each value from google but these values explanation is searchable through the internet.

You can check this value owasp-crs-v030301-id921150 under Protocol Attack[1] for a detailed information.

[1]https://cloud.google.com/armor/docs/waf-rules#protocol_attack