How do inheritance and "Rule Source" work in rules?

Short answer

A rule does not have to define its own inspection for every tab. If an Exact path rule has not defined the common rule of a section or the argument rule of a name, that part is taken from the glob rule that matches the path, and if there is none, from the Any Paths rule (exact → glob → Any paths). In the Check Fields panel, the Rule Source row below an inherited common rule shows the path of the source; in the variable table, the rule's own rows appear bold and the inherited ones italic, and inherited rows are edited only from the source rule. When the rule defines its own common rule or its own argument rule with the same name, the inheritance ends for that part. Path inspections are never inherited; the panel shows the inheritance only in exact rules.

How Does It Work?

In a request that matches an exact rule, the inspections for every section (Query, Header, JSON, Xml, Form, Raw) are searched in this order and the first one found is used:

1. The rule's own part.
2. The part of the glob rule that matches the path; if more than one glob matches, the glob rule that defines that part and was defined first; the following ones only complete the parts that are not defined (runtime rule matching).
3. The part of the Any Paths rule.

Situation	Result
The rule has no common rule for the section	The common rule of the matching glob rule is used, and if there is none, that of the Any paths rule
The rule has no argument rule for a name	The argument rule with the same name in the matching glob rule is used, and if there is none, that of the Any paths rule; if there is none in any of them, the name is inspected with the value inspections of the applicable common rule
The rule defined its own common rule	The common rule of that section is no longer inherited; the argument rules in other rules continue to be inherited by their names
The rule defined an argument rule for a name	The value inspections of the common rule are not applied for that name; a field left empty in the argument rule means no restriction for that inspection
Path (Allowed methods, Path length, Path depth, OWASP check)	Not inherited; the rule's own value always applies

Where Is It Seen in the Panel?

Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → the N page types row of the host group → the exact rule in the list is clicked and the tab is selected in the detail panel (accessing the panel):

• Common rule: If the values are inherited, the Rule Source row and the path of the source rule (Any paths for the Any paths rule) appear below the table; if the rule defines its own common rule, this row is not present. In an inherited common rule, Add Common Rule for … appears instead of the edit button; with it, the rule's own common rule is added to the rule.
• Variable table: The rule's own rows are bold and the inherited ones are italic. When a row is clicked, its detail opens; the detail of an inherited row has the Rule Source row and does not have the Edit and Delete buttons.
• Pre-filling: The Add Common Rule for … and Add Argument Rule for … forms open filled with the common values of the Any paths rule in that section; after the save, the values are independent, and even if the Any paths rule changes later, this rule does not change.
• Glob rules: In the panel of a glob rule, inherited rows are not shown. So that it can be read from the panel which section is inspected with which values in requests that match the glob rule, the necessary sections are defined in the glob rule itself.

Path matching priority: If a request matches more than one page type, how are the rules applied (exact path priority, glob rules merged with Any Paths)?

Common Misconceptions

• "A field left empty in the argument rule comes from the common rule." When the argument rule is defined, the value inspections of the common rule are not applied for that name; an empty field means no restriction for that inspection.
• "A rule that defines its own common rule takes nothing from Any paths." Only the common rule of that section is not inherited; the name-specific argument rules in Any paths (e.g. the default header rules) continue to be inherited unless the same name is defined in the rule (What are the default header rules?).
• "A change made in Any paths is also reflected in the rules created from it with pre-filling." Pre-filling is only the initial values of the form; the saved common or argument rule does not stay bound to Any paths.

How it is done in the documentation

• Path Check Fields · The Inheritance and Rule Source
• Path Check Fields · Two Layers: The Common Rule and the Argument Rule
• WAF Rules · Runtime: Rule Matching

Related questions

• If a request matches more than one page type, how are the rules applied (exact path priority, glob rules merged with Any Paths)?
• What is the Any Paths rule?
• What is Check Fields; into which seven parts does the WAF split a request to inspect it?