What is CWE; why does it appear in TR7 WAF logs and reports?

Short answer

CWE (Common Weakness Enumeration) is the standard catalog of software and hardware security weakness types maintained by MITRE; each weakness type has a code such as CWE-89 (SQL Injection). It defines not a vulnerability in a specific product but the type of weakness that leads to a vulnerability, and it serves to express which weakness an attack targets in a common language across tools. TR7 maps the WAF signatures to CWE codes; for this reason, CWE appears in the CWE Coverage card and in the CWE column in Signature & Rule Library, in the CWE filter and in the log preview in WAF Event Logs, and in the Top CWE indicator on the Overview tab of WAF Report and on its Classification tab; if CWE (List) is selected in the Attack Details in WAF Info field, it is also included in the attack record sent to the SIEM. In the custom rules added by the user and in the built-in rules without a CWE mapping, this field remains empty.

Where It Is Used in TR7

Where	Field / label	What for
WAF → Signature & Rule Library	CWE Coverage card; CWE column; Filter → CWE Coverage	The number of distinct CWE codes in the signatures; the CWE codes of a rule
WAF-Protected vService → Event Logs	CWE filter; the CWE row on the Summary tab of the preview	The weakness types targeted by the triggered signatures
WAF Management → WAF Report	Overview → Top CWE; Classification → CWE	The weakness types targeted most in the period
WAF Management → SIEM & Attack Details	Attack details in WAF info → CWE (List)	Adding the cwe field to the attack record sent to the SIEM; if the rule does not carry a CWE, the value is sent as null

Common Misconceptions

• "CWE is a vulnerability number." CWE indicates the weakness type; an individual vulnerability in a specific product is identified with a CVE code.
• "Every rule has a CWE code." In the custom rules added by the user and in some built-in rules without a CWE mapping, the field is empty.
• "CWE and CAPEC describe the same thing." CWE defines the targeted weakness, and CAPEC the attack pattern the attacker uses: What is CAPEC; how does it differ from CWE?

Seeing the CWE and other mappings of a rule: How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?

How it is done in the documentation

• Signature & Rule Library · The Library Summary Cards
• WAF Event Logs · Summary Tab
• SIEM Attack Details · Attack Details in WAF Info

Related questions

• How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?
• Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?
• What is CAPEC; how does it differ from CWE?