WAF - WAAP

Questions on signatures, scoring, operating modes, learning and false positive management. Search for a question, filter by level or jump to a category.

01FundamentalsWhat a WAF is, security models and the building blocks of TR7 WAF

• What is a WAF and what does it do?WAF-01-001
• I already have a network firewall; why would I also need a WAF?WAF-01-002
• What is the difference between IPS/IDS and a WAF?WAF-01-003
• My application's code was written securely; is a WAF still necessary?WAF-01-004
• Which attacks does TR7 WAF protect against?WAF-01-005
• Which vService types does TR7 WAF work with; can I use it on an L7 TCP or Network vService?WAF-01-006
• Can the WAF see the content of HTTPS traffic; what is required for that?WAF-01-007
• What is the difference between the negative security model (signature scanning) and the positive security model?WAF-01-008
• What is TR7's hybrid security model; how do the two models work together?WAF-01-009
• Which stages does a request go through inside TR7 WAF?WAF-01-010
• What are the basic building blocks of TR7 WAF (WAF Mode, Virtual Host Group, Page Types, Any Paths, Check Fields, Signature)?WAF-01-011
• Which decisions does the WAF make for a request; what do Action in Event Logs and Verdict in Debug Mode Logs mean?WAF-01-012
• Can TR7 WAF catch a zero-day attack without a signature?WAF-01-013

02Enablement and Initial SetupEnabling WAF, default settings and a safe go-live

• How do I enable WAF protection on a vService?WAF-02-001
• What is the difference between the two ways of enabling WAF (from the list / from the vService form)?WAF-02-002
• Does traffic start being blocked as soon as I enable the WAF?WAF-02-003
• Which default settings are created when WAF is enabled?WAF-02-004
• What should I do first after enabling the WAF?WAF-02-005
• How do I remove WAF protection from a vService?WAF-02-006
• Can I enable or disable WAF on several vServices at once?WAF-02-007
• If I remove WAF protection, are the learned rules and settings deleted?WAF-02-008
• How do I deploy the WAF on a live site without risking an outage?WAF-02-009
• What is the recommended life cycle (Learning → Monitor → Blocking); how long should I stay in each stage?WAF-02-010
• How do I prepare the WAF for an application that is about to launch, while there is no traffic yet?WAF-02-011
• Which requests are treated as "static content" and excluded from WAF inspection (extension, method, query and body conditions); is this safe?WAF-02-012

03Operating ModesBehavior of and transitions between Learning, Monitor and Blocking modes

• What are the WAF operating modes?WAF-03-001
• What does the WAF do in Learning mode; are attacks blocked?WAF-03-002
• What does the WAF do in Monitor mode?WAF-03-003
• What does the WAF do in Blocking mode?WAF-03-004
• In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?WAF-03-005
• When should I move from Learning to Monitor and from Monitor to Blocking?WAF-03-006
• Can I use different modes for different domains on the same vService?WAF-03-007
• What is the risk of staying in Monitor mode; is there a time limit for Monitor mode?WAF-03-008
• Can I still keep learning certain traffic while in Blocking mode (Conditional Learning)?WAF-03-009
• If the application changes after moving to Blocking, should I go back to Learning mode?WAF-03-010
• Can a request be blocked with 418 even in Learning or Monitor mode?WAF-03-011
• Can I enable TR7 WAF directly in Blocking mode without using Learning mode?WAF-03-012

04Scoring, Threshold and OWASP Protection LevelThe blocking decision, attack score and protection level

• How does TR7 WAF decide whether to block a request?WAF-04-001
• What is the attack score and how is it calculated?WAF-04-002
• What is the OWASP Protection Level; how many levels are there?WAF-04-003
• What is the default protection level?WAF-04-004
• Which protection level should I choose (Elementary, Normal, Tight, Very Tight and Aggressive)?WAF-04-005
• How does tightening the protection level affect false positives?WAF-04-006
• In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?WAF-04-007
• Can I set the protection level separately for each domain / host group?WAF-04-008
• What does the "Max. Owasp Exclusions" setting do; what happens if the limit is exceeded?WAF-04-009
• If a request contains several attacks, does the WAF stop at the first match or evaluate all of them?WAF-04-010

05Signature and Rule LibrarySignatures, rule layers, custom rules and the OWASP Rules screen

• What is a signature?WAF-05-001
• How many signatures / rules does TR7 WAF have?WAF-05-002
• Which attack categories do the signatures cover?WAF-05-003
• Where can I see the rules in the library?WAF-05-004
• What is the difference between a signature and a pattern; why are "Unique Signature Patterns" and "Total Active Signatures" different numbers?WAF-05-005
• In which parts of a request are signatures scanned (Path, Query, Header, JSON, XML, Form and Raw)?WAF-05-006
• Are cookies scanned?WAF-05-007
• What are the rule layers (built-in library, global layer, vService layer); which one takes precedence?WAF-05-008
• Can I disable a signature on a single vService only, rather than device-wide?WAF-05-009
• What does a signature's state (Enabled / Monitor / Disabled) mean?WAF-05-010
• Can I change a signature's score (Low / Medium / High / Very High)?WAF-05-011
• How do I add my own custom rule (regex)?WAF-05-012
• What is the "Inspection Scopes" field for when adding a custom rule?WAF-05-013
• How do I revert my changes to the default (Restore to Default)?WAF-05-014
• How do I try a new signature in production without risk (Monitor state)?WAF-05-015
• How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?WAF-05-016
• What does "Protected Target Types" mean?WAF-05-017
• What is Recompile and when is it needed?WAF-05-018
• What is the difference between the vService's OWASP Rules screen and the global Signature & Rule Library screen?WAF-05-019
• How does the protection level affect what the OWASP Rules screen shows?WAF-05-020
• Which regex syntax is supported in custom rules (backreference, lookaround); can I test a rule before saving it?WAF-05-021
• If my custom rule fails to compile, does the WAF keep protecting; how do I find out?WAF-05-022
• If I change a built-in signature's score, state or scan scopes, how do I see the original (Original Rule / Edited Rule)?WAF-05-023

06Positive Security: Page TypesPage types, Any Paths, glob patterns, Merge, Import and Export

• What is a Page Type?WAF-06-001
• What is the Any Paths rule?WAF-06-002
• Where do WAF rules come from (learning analysis, teaching from logs, manual definition)?WAF-06-003
• How do I add a new page type manually?WAF-06-004
• What is the difference between an Exact Path and a glob path?WAF-06-005
• How are glob patterns (*, **) written; how is the path test tool used?WAF-06-006
• Can I allow only certain HTTP methods on a page (Allowed Methods)?WAF-06-007
• What are the Path Length and Path Depth constraints for?WAF-06-008
• If a request matches more than one page type, how are the rules applied (exact path priority, glob rules merged with Any Paths)?WAF-06-009
• How is a request that matches no page type inspected?WAF-06-010
• Can I delete the Any Paths rule?WAF-06-011
• How do I merge several page types into one rule (Merge)?WAF-06-012
• How are settings (methods, OWASP) combined during a Merge?WAF-06-013
• Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?WAF-06-014
• What happens to existing rules when I Import (full replacement)?WAF-06-015
• Can I generate rules automatically from my OpenAPI / Swagger file?WAF-06-016
• What does turning OWASP scanning on or off at the Page Type level mean?WAF-06-017
• What do the Force Merge and Keep Original Rules options do?WAF-06-018
• How do I reset the rules to the default settings?WAF-06-019
• Why can't the Any Paths rule be merged with other rules?WAF-06-020

07Check FieldsPath, Query, Header, JSON, XML, Form and Raw checks

• What is Check Fields; into which seven parts does the WAF split a request to inspect it?WAF-07-001
• How do inheritance and "Rule Source" work in rules?WAF-07-002
• How do I make sure only the query parameters I allow reach a page (Allowed Query Parameters)?WAF-07-003
• Can I define required parameters (Required Query Parameters / Required Headers / Required Form Fields)?WAF-07-004
• Can I limit parameter name length and parameter count?WAF-07-005
• Can I restrict a parameter's value by length or regex pattern (Value length / Value pattern)?WAF-07-006
• Can I limit how many times the same parameter may repeat (Value count)?WAF-07-007
• Can I limit the total header / query size?WAF-07-008
• Can I require a specific header to be present?WAF-07-009
• What are the default header rules?WAF-07-010
• Can I block malformed (unparseable) JSON / XML / form bodies?WAF-07-011
• Can I forbid JSON or XML bodies entirely on a page (Block All JSON Contents / Block All XML Contents)?WAF-07-012
• Can I limit JSON / XML nesting depth?WAF-07-013
• Can I allow only specific keys in JSON; how are nested key paths written?WAF-07-014
• How are element and attribute paths defined in XML?WAF-07-015
• Can I allow only certain MIME types in file uploads?WAF-07-016
• Is the content of uploaded files scanned as well (OWASP Check in Upload)?WAF-07-017
• Can I turn off OWASP scanning for a specific parameter?WAF-07-018
• What does the "Detailed Log" option do; is a log written if I turn it off?WAF-07-019
• What does the Raw tab inspect; what happens to content that cannot be parsed?WAF-07-020
• What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?WAF-07-021
• What is Allowed Raw Body Mime Types used for?WAF-07-022
• What is the Raw inspection order?WAF-07-023
• Is form data scanned both raw and URL-decoded?WAF-07-024
• Does the file type check look at the client's Content-Type or at the file's content?WAF-07-025
• In multipart requests, is the whole body scanned separately as well?WAF-07-026

08Inspection & Blocking SettingsBlocking page, whitelist/blacklist, checks and body limits

• What does a blocked user see?WAF-08-001
• Can I change the blocking page?WAF-08-002
• Why is the 418 status code returned by default on a block; can I change it?WAF-08-003
• Can I exempt certain IPs or requests from WAF inspection entirely (Whitelist Condition)?WAF-08-004
• Can I automatically block requests from IPs with a bad reputation (Blacklist Protection)?WAF-08-005
• What are the ready-made blocking page templates (Turkish, English, JSON)?WAF-08-006
• Can I show a blocking page based on the visitor's language?WAF-08-007
• Can I return a JSON blocking response instead of HTML for API clients?WAF-08-008
• Can I define different blocking pages depending on conditions (Conditional Blocking Pages)?WAF-08-009
• Which Smart Variables can I use on the blocking page (%UID, %SRCIP, %WAFSCORE, %WAFINFO …); is it safe to show attack details?WAF-08-010
• What do the Structure Checks and Argument Checks master switches do; what happens if I turn them off?WAF-08-011
• What does the URL Decoding setting affect; are query and form values decoded too?WAF-08-012
• What is Max. Allowed Arguments for; what happens if a page's learned argument list exceeds this number?WAF-08-013
• What happens to request bodies that exceed the Max. Body Size to Process(kB) limit or do not complete in time?WAF-08-014
• How is a body that exceeds the Max. Body Size to Log(kB) limit written to the log; should I raise this limit?WAF-08-015
• What is "Wait for body for a time" for?WAF-08-016
• With "Do not WAF static contents" on, under which condition is a request considered static?WAF-08-017
• How do I define a vService-specific IP blacklist (Frontend Blacklist) and its exclusions (Frontend Blacklist Exclusions)?WAF-08-018
• Is the traffic I whitelist logged at all; where does it appear on the dashboard?WAF-08-019
• Does "Add to Whitelist (vService)" in Event Logs exempt an IP from WAF inspection, or does it only add a blacklist exclusion?WAF-08-020
• What is the difference between the vService blacklist and the IP intelligence list?WAF-08-021
• What is the maximum value of Max. body size to process; how does it relate to the log limit?WAF-08-022

09Learning: Analysis & Learning, AI Learning, TeacherLearning log, analysis, AI Learning, Teacher and Conditional learning

• How does the WAF "learn" my application?WAF-09-001
• How long does learning take; how do I know it is finished?WAF-09-002
• What do Learning Coverage and Learning Discovery Rate mean?WAF-09-003
• Is my site protected during learning?WAF-09-004
• What is the learning log; where is it kept?WAF-09-005
• What is Smart Sampling; how does it affect the learning log?WAF-09-006
• How do I generate rules from past traffic with Analysis & Learning?WAF-09-007
• What is the difference between the Rule Creating Mode options (Comprehensive, Data Based, Page Independent); which one should I choose?WAF-09-008
• What is the difference between "Create New Rules" and "Combine with Old Rules" in the analysis?WAF-09-009
• How do I keep attack traffic out of the analysis (country, blacklist, bot, status code, source IP filters)?WAF-09-010
• What are the "Only Domains" and "Only Browsers" filters for?WAF-09-011
• Can I review and edit the analysis result before applying it (Analyze Page Types screen)?WAF-09-012
• What happens when I apply an analysis result?WAF-09-013
• Can I run an analysis for several host groups at once (Collective Analysis)?WAF-09-014
• What is AI Learning and how does it work?WAF-09-015
• What is Teacher; which sources can I define as Teacher (IP, header, cookie)?WAF-09-016
• What is the difference between AI Learning and Teacher?WAF-09-017
• How is Learning Progress read (Request, Client, Country, ASN network axes); why is the lowest axis decisive?WAF-09-018
• Can I apply AI Learning's suggestions manually without waiting for it to apply them automatically (Learn Selected)?WAF-09-019
• How do I see what AI Learning and Teacher applied in the past?WAF-09-020
• Can I revert a learned rule?WAF-09-021
• Does changing the Rule Creation Policy change existing rules?WAF-09-022
• What do the AI Learning evaluation periods (30 min / 1 day … 1 day / 3 months) mean?WAF-09-023
• What are the Min Progress (%), Max Suggestions and Line Limit advanced settings for?WAF-09-024
• What are Dynamic Paths, Excluded Paths and Dynamic Path Exclusions for?WAF-09-025
• Why are there Min Requests, Min Visitors, Min Ips, Country Limit filters?WAF-09-026
• When should the "Don't Learn OWASP Exclusions" option be checked?WAF-09-027
• What is the difference between Conditional Learning and Teacher; when should I use which?WAF-09-028
• Can an attacker fool AI Learning by making their traffic look widespread; how is this risk reduced?WAF-09-029
• What is the risk of a wrongly defined Teacher?WAF-09-030
• What happens if I enter an incorrect format (invalid IP) for the Teacher identity?WAF-09-031
• What should the name of the Teacher Header or cookie be (TR7-LEARN); which name is used for Conditional Learning (TR7-ANALYZE)?WAF-09-032
• Why is the AI Learning & Teacher Tracking tab not visible?WAF-09-033
• Can I stop a running analysis; how many analyses can be kept at most?WAF-09-034
• How long until Teacher traffic becomes a rule; is a single request enough?WAF-09-035
• Can I define an IPv6 address for Teacher?WAF-09-036
• Why are rules learned from headers written to the Any Paths rule rather than per page?WAF-09-037

10False Positive ManagementFinding wrong blocks and fixing them with Allow / Teach

• What is a false positive?WAF-10-001
• How do I tell that a legitimate request was blocked by the WAF?WAF-10-002
• How do I allow a request that was blocked by mistake?WAF-10-003
• Which rule changes in the background when I Allow / Teach (Learning Suggestion)?WAF-10-004
• Should I fix a false positive for a single parameter only or for the whole page?WAF-10-005
• How do I edit the matching rule from a log with "Edit Corresponding Rule"?WAF-10-006
• Is it better to disable a signature entirely or to add an OWASP exclusion?WAF-10-007
• How do I use Monitor mode to weed out false positives?WAF-10-008
• How is Teacher used to reduce false positives?WAF-10-009
• How do I make sure a certain user group (e.g. internal network, test team) is never blocked?WAF-10-010
• How do I fix the same false positive on several vServices at once (global layer)?WAF-10-011
• How do I find a signature that produces too many false positives?WAF-10-012
• False positives increased after an application update; what should I do?WAF-10-013
• How do I assess whether a false positive fix creates a security gap?WAF-10-014
• Can I blacklist an attacker IP directly from Event Logs (Attacker IP → Actions)?WAF-10-015
• Can I Allow / Teach several logs at once; are attacks hidden by the filter taught as well?WAF-10-016

11Virtual Host GroupsHost groups, patterns, the default group and per-group mode

• What is a Virtual Host Group and what is it for?WAF-11-001
• What is the default host group?WAF-11-002
• Can I apply different WAF rules to different domains behind the same vService?WAF-11-003
• How is a Host Group added; what goes into the Virtual Host Patterns field?WAF-11-004
• Which host group does a request fall into; what if it matches none?WAF-11-005
• If I delete a host group, what happens to its rules?WAF-11-006
• Is the WAF mode assigned to the vService or to the host group; how are the modes of several groups summarized on screen?WAF-11-007
• Can I use wildcards (*.example.com) in the Virtual Host Patterns field, or is an exact match required?WAF-11-008
• How does the quota work when analyzing many host groups collectively?WAF-11-009
• In which mode does a host group I have just added start?WAF-11-010
• Can the default host group be deleted?WAF-11-011
• Which host group does a request without a Host Header fall into?WAF-11-012

12Monitoring, Logging, Reporting and NotificationsDashboard, Event Logs, reports, notifications and SIEM

• Where do I watch what the WAF is doing?WAF-12-001
• Which tabs does the WAF Dashboard have (Summary, Attack Analysis, Learning); why is the Learning tab not always visible?WAF-12-002
• What are Event Logs; which requests are logged?WAF-12-003
• How do I see the list of blocked requests?WAF-12-004
• Can I see the WAF logs of all vServices on one screen (Global WAF Event Log)?WAF-12-005
• How is a WAF report created; which formats are available in the UI and by e-mail (HTML, PDF, XLSX)?WAF-12-006
• What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?WAF-12-007
• What does the flow diagram on WAF screens (Data Flow Panel) show?WAF-12-008
• What is monitored for the WAF on the Live Stats screen?WAF-12-009
• What do the Action values in Event Logs mean?WAF-12-010
• How are the Severity levels (Blacklist, Structural, Very High … Very Low) determined?WAF-12-011
• How do I filter logs by fields such as IP, country, ASN, path, signature, category, OWASP and CWE?WAF-12-012
• What do I see in a log record's details (Summary, Attacks, Request & Location)?WAF-12-013
• Can I see how long a request spent in the WAF (WAF Time)?WAF-12-014
• Is the request body written to the log?WAF-12-015
• How do I find a specific request by its Request Unique ID?WAF-12-016
• Can I receive reports regularly by e-mail; at what times are they sent?WAF-12-017
• Can I get a single WAF report for the whole device (Global WAF Report)?WAF-12-018
• Can I receive a notification when the attack count exceeds a certain threshold?WAF-12-019
• What are the notification channels (UI, e-mail, SMS, SNMP)?WAF-12-020
• How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?WAF-12-021
• Can I send only attack records to the SIEM?WAF-12-022
• How does scope (Global, Source IP, Source Subnet, Country, ASN, Host Header …) work in advanced notifications?WAF-12-023
• What is the difference between "Blocks" and "Detections" in a notification?WAF-12-024
• Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?WAF-12-025
• Is the attack payload sent to the SIEM (Same as 'detailed log' / Always Send / Never Send)?WAF-12-026
• How do I stop WAF logs of Health Check or probe traffic (WAF Log Suppression Condition)?WAF-12-027
• Can I produce a report containing only certain attacks with the report filter?WAF-12-028
• Can I see the WAF status of all vServices at a glance on the home page?WAF-12-029
• Where do I see the WAF notifications that were sent (Notification Logs)?WAF-12-030
• Can I export Event Logs as Excel, CSV or PDF?WAF-12-031
• Which Event Logs columns are hidden by default; how do I show them?WAF-12-032
• How long are WAF logs kept?WAF-12-033
• How do I set the report language and the maximum number of rows in a report?WAF-12-034
• Can I write advanced filters in Event Logs with AND/OR, NOT, regex and JSONata expressions?WAF-12-035
• What exactly does the WAF Time value measure?WAF-12-036
• In a cluster, which device do WAF logs come from; how do I distinguish the device in Event Logs?WAF-12-037

13Performance and CapacityLatency, large bodies, heavy traffic and scan time

• Does the WAF slow down my site?WAF-13-001
• How do I measure the time the WAF adds to a request; for which requests is it visible?WAF-13-002
• Does latency grow as the number of rules grows?WAF-13-003
• How do large request bodies (file uploads) affect WAF performance?WAF-13-004
• What does excluding static content from inspection gain in performance?WAF-13-005
• How are the disk and CPU load of the learning log kept under control (Smart Sampling)?WAF-13-006
• How does WAF inspection behave under heavy traffic?WAF-13-007
• What happens to a request if the scan exceeds a certain time (2-second scan limit)?WAF-13-008

14Bot/DDoS ProtectionBot management, L7 DDoS protection, IP reputation, CAPTCHA and Waiting Room

• What is the difference between the Off, Monitor and Active modes of Bot/DDoS protection; is traffic blocked as soon as I enable it?WAF-14-001
• How do I move Bot/DDoS protection settings to another vService or device (Export / Import)?WAF-14-002
• Can I limit the number of connections a single IP address can open (Source IP Connection Protection)?WAF-14-003
• Can I automatically block a client that generates many 404 and other 4xx errors (directory scanning)?WAF-14-004
• How do I review and selectively apply the Bot/DDoS learning engine's suggestions; can an applied suggestion be undone?WAF-14-005
• What is monitored on the Bot/DDoS Live Stats screen?WAF-14-006
• Can I see the Bot/DDoS events of all vServices on one screen (Global Event Log)?WAF-14-007

15API and Modern Application ProtectionREST, OpenAPI, JSON/XML, GraphQL, SSRF and prompt injection

• Can I protect my REST APIs with TR7 WAF?WAF-15-001
• How do I set up a positive security model for an API (allowed endpoints, methods, parameters)?WAF-15-002
• Can I generate API protection rules automatically from my OpenAPI definition?WAF-15-003
• Can I apply schema-like checks (key list, depth, length) to JSON-bodied API requests?WAF-15-004
• Can I protect my SOAP / XML services; is there protection against XXE attacks?WAF-15-005
• Can I protect my mobile application's backend API?WAF-15-006
• Is there protection against SSRF and cloud metadata (169.254.169.254) access attempts?WAF-15-007
• Can it catch prompt injection attacks against my LLM / AI services?WAF-15-008
• Can I protect GraphQL requests?WAF-15-009
• Is there protection against HTTP request smuggling and parameter pollution attacks?WAF-15-010

16Relationship and Integration with Other Products and Add-onsLoad Balancer, Bot/DDoS, AGS, Trusted Proxy and condition integration

• How does the WAF work together with the Load Balancer?WAF-16-001
• What is the difference between WAF and L7 DDoS & Threat Protection; do I need both?WAF-16-002
• What is the order when WAF and AGS are used together?WAF-16-003
• If there is a CDN / proxy in front of TR7, how does the WAF see the real client IP?WAF-16-004
• Can I take a different action on the Load Balancer side based on the attack the WAF detected (WAF Attack Signature / Signature Group condition)?WAF-16-005
• Is the WAF's IP reputation information shared with IP Reputation protection in L7 DDoS & Threat Protection?WAF-16-006
• Where do geolocation and IP reputation data come from and how often are they updated?WAF-16-007

17Troubleshooting418 errors, unblocked attacks, empty logs and learning problems

• My users are getting a "418" error; what is happening?WAF-17-001
• The site is not working after I enabled the WAF; what should I check first?WAF-17-002
• An attack attempt was not blocked; why?WAF-17-003
• No records appear in Event Logs; why?WAF-17-004
• File uploads are being blocked by the WAF; how do I fix it?WAF-17-005
• Large POST requests are blocked or cut off; why?WAF-17-006
• JSON requests from my API are blocked by the "Block Invalid JSON Contents" rule; why?WAF-17-007
• The logs show the proxy / CDN IP instead of the client IP; what should I do?WAF-17-008
• Learning Coverage has not increased for a long time; why?WAF-17-009
• AI Learning produces no suggestions; why?WAF-17-010
• Teacher traffic is not recognized; why?WAF-17-011
• The analysis produced very few page types / none at all; which filters should I check?WAF-17-012
• New pages are blocked after I released a new version; what should I do?WAF-17-013
• Why does a request that received 418 not appear in Event Logs?WAF-17-014
• I turned off upload scanning but files are still blocked; why?WAF-17-015
• I see rule 369999 in Debug Mode Logs or SIEM records; what is it?WAF-17-016

18Operations and ManagementBackup, migration, change history, API/CLI and bulk operations

• Where do I see a vService's whole WAF configuration on one screen (WAF Management)?WAF-18-001
• Where do I see the list of WAF-protected vServices (WAF-Protected vService List)?WAF-18-002
• Can I back up my WAF rules?WAF-18-003
• How do I move the WAF rules I prepared in a test environment to production?WAF-18-004
• How should I include the WAF in my application release process?WAF-18-005
• Where do I see the change history of WAF settings?WAF-18-006
• How is a consistent WAF policy managed across many vServices?WAF-18-007
• Can I manage the WAF with WEB-CLI; which operations are not available in WEB-CLI?WAF-18-008
• Can I change the WAF settings or host group mode of several vServices at once?WAF-18-009
• Can I extract only the WAF rules from an old system backup (Export WAF Rules)?WAF-18-010