False Positive Management

Finding wrong blocks and fixing them with Allow / Teach.

• What is a false positive?WAF-10-001
• How do I tell that a legitimate request was blocked by the WAF?WAF-10-002
• How do I allow a request that was blocked by mistake?WAF-10-003
• Which rule changes in the background when I Allow / Teach (Learning Suggestion)?WAF-10-004
• Should I fix a false positive for a single parameter only or for the whole page?WAF-10-005
• How do I edit the matching rule from a log with "Edit Corresponding Rule"?WAF-10-006
• Is it better to disable a signature entirely or to add an OWASP exclusion?WAF-10-007
• How do I use Monitor mode to weed out false positives?WAF-10-008
• How is Teacher used to reduce false positives?WAF-10-009
• How do I make sure a certain user group (e.g. internal network, test team) is never blocked?WAF-10-010
• How do I fix the same false positive on several vServices at once (global layer)?WAF-10-011
• How do I find a signature that produces too many false positives?WAF-10-012
• False positives increased after an application update; what should I do?WAF-10-013
• How do I assess whether a false positive fix creates a security gap?WAF-10-014
• Can I blacklist an attacker IP directly from Event Logs (Attacker IP → Actions)?WAF-10-015
• Can I Allow / Teach several logs at once; are attacks hidden by the filter taught as well?WAF-10-016