Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a false positive?
Short answer
A false positive is the marking of a legitimate request as an attack by WAF. It arises mainly from two sources: a signature matches in the request's own data (e.g. the word select in a comment field, the < character in a JSON value) or the request overflows the learned limits of the page type (parameter length, allowed method, allowed parameter list). Signature hits get 2 to 8 points (9 in three built-in rules), and structural violations get 24 points (violation scores); when the total score reaches the blocking threshold of OWASP Protection Level, the request is blocked in Blocking mode and only recorded in Monitor mode. In Learning mode, signature hits are not added to the score and the request is not blocked. A corporate VPN address being on the blacklist and the scan not being completed within the time limit in Blocking mode can also stop a legitimate request. A false positive is read on the WAF Event Logs screen: the Description on the Attacks tab of the record highlights the part of the request that matched the signature. Allow / Teach on the same screen does not turn off the signature; it writes an exclusion to the page type the request matched or widens the related limit.
How Does It Work?
WAF evaluates a request not according to a single rule but according to the total score: every violation is added to the score, the request is scanned as a whole and the decision is given at the end of the scan (how it works). If the score of a legitimate request reaches the threshold, a false positive occurs.
| Type | How it occurs | Score | Typical fix |
|---|---|---|---|
| Signature hit | A signature matches in the legitimate data of the application | 2–8 (9 in three built-in rules) | An OWASP exclusion on the related field (Which rule changes in the background when I Allow / Teach (Learning Suggestion)?) |
| Structural violation | A limit such as the value length, the allowed method or the allowed parameter list is exceeded | 24 | Widening the related limit |
| Blacklist hit | The source address is on the IP reputation blacklist (e.g. a corporate VPN exit) | 100 | A blacklist exclusion (Does "Add to Whitelist (vService)" in Event Logs exempt an IP from WAF inspection, or does it only add a blacklist exclusion?) |
| Scan time limit | In Blocking mode, a request whose scan cannot be completed within the time limit is blocked; no Event Logs record is created | - | Reducing the body and the scan load; if these blocks affect the service, Fail-open in the Request Body Limits window (while it is on, these requests pass without being scanned) (What happens to a request if the scan exceeds a certain time (2-second scan limit)?) |
The threshold is determined with OWASP Protection Level; as the level gets stricter, even a single low-scoring signature can be enough to block (How does tightening the protection level affect false positives?).
False Positive Management in TR7
| Surface | What it is for |
|---|---|
| WAF Event Logs → Attacks tab | Shows the matched signature, the matched part (Description), the matched rule (Corresponding Rule) and what the teaching operation will change (Learning Suggestion) (How do I tell that a legitimate request was blocked by the WAF?) |
| Allow / Teach | Teaches the record to the rule set (How do I allow a request that was blocked by mistake?) |
| Edit Corresponding Rule | Edits the matched rule manually from the log (How do I edit the matching rule from a log with "Edit Corresponding Rule"?) |
| Monitor mode | Tries the rule set on real traffic without blocking (How do I use Monitor mode to weed out false positives?) |
| Teacher and AI Learning | Teaches false positives automatically in certain periods (How is Teacher used to reduce false positives?) |
| OWASP Rules | Puts the problematic signature into the Monitor or Disabled state on the vService (Is it better to disable a signature entirely or to add an OWASP exclusion?) |
| Whitelist Condition | Keeps certain requests entirely outside the WAF inspection |
The recommended order is the typical deployment flow in the docs: learning in Learning mode, weeding out false positives in Monitor mode, then Blocking.
Common Misconceptions
- "Fixing a false positive means turning off the signature." Allow / Teach writes an exclusion only to the matched page type or field; the signature continues to work on the other pages and fields.
- "False positives do not occur in Monitor mode." They occur, but the request is not blocked; the record goes to Event Logs and is taught from there.
- "If Event Logs is empty in Learning mode, there are no false positives." In Learning mode, no Event Logs record is produced; false positives become visible when the host group switches to Monitor or Blocking mode.
How it is done in the documentation
