What are OWASP and the OWASP Top 10; where do they appear in the TR7 WAF?

Short answer

OWASP (Open Worldwide Application Security Project) is an open, non-profit community that works on software security (OWASP). The OWASP Top 10 is the list of the ten most critical web application security risk categories published by this community; the mapping in TR7 is based on the 2021 version (A01:2021–A10:2021) (OWASP Top 10:2021). TR7 WAF tags its signatures, where a mapping is defined, with these categories: the OWASP Web Coverage card on the Signature & Rule Library screen shows how many categories the library covers, the Classification tab of the rule preview shows the mapping of the rule, and the Detected Attacks by OWASP Top 10 (Web) panel in the WAF Dashboard shows the distribution of detections across the categories; Event Logs records are filtered with the OWASP Web filter. The OWASP Protection Level in WAF, on the other hand, is not related to the Top 10 list; it determines the threshold at which the attack score turns into blocking.

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → WAF → Signature & Rule Library	OWASP Web Coverage card	How many of the Top 10 categories the library covers
Signature & Rule Library → rule preview	Classification tab; the OWASP Web Coverage column opened with Columns	Seeing the Top 10 mapping of a rule
Signature & Rule Library → Filter	OWASP Web Coverage group (e.g. A03:2021)	Listing the rules mapped to a Top 10 category
Left Monitor Panel → WAF-Protected vServices → vService → Dashboard	Detected Attacks by OWASP Top 10 (Web)	The distribution of detections across the A01–A10 categories
WAF-Protected vServices → vService → Event Logs	Filter strip → OWASP Web; the Summary tab of the record preview	Filtering the records by Top 10 category and seeing the categories of a request

• The list specific to APIs: What is the difference between the OWASP Top 10 (Web) and the OWASP API Top 10?
• Steps for seeing the mappings of a rule: How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?

Common Misconceptions

• "The OWASP Top 10 is a signature set." The Top 10 is a list of risk categories; TR7 maps its own signatures to these categories. A signature can be mapped to more than one category, and a detection is reflected in each category separately.
• "OWASP protection level is the same thing as the Top 10." OWASP Protection Level determines the blocking threshold of the WAF; for details, see What is the OWASP Protection Level; how many levels are there?
• "Every signature has a Top 10 mapping." The mapping exists only in the signatures for which a mapping has been defined; in some built-in signatures and in the custom rules added with the rule add form, this field is empty.

How it is done in the documentation

• WAF · What Is the Classification Good For?
• Signature & Rule Library · The Library Summary Cards
• WAF Dashboard · Detected Attacks by OWASP Top 10 (Web)
• Event Logs · The Filter Strip

Related questions

• How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?
• How do I filter logs by fields such as IP, country, ASN, path, signature, category, OWASP and CWE?
• What is the OWASP Protection Level; how many levels are there?
• What is the difference between the OWASP Top 10 (Web) and the OWASP API Top 10?