How do I use Monitor mode to weed out false positives?

Short answer

While the host group runs in Monitor mode, the rule set makes the same inspections as in Blocking mode (signature scanning, structural and parameter inspections, scoring), but the request is not blocked; every request that would be blocked in Blocking mode is written to the WAF Event Logs screen with the Not blocked — Monitor mode decision. The group is switched to Monitor by setting WAF Mode = Monitor Mode in the Edit window on the mode card and is kept there for a period that covers all the workflows. Then, in Event Logs, the untaught records are found by selecting No and Partly in the Learn Status tab of the filter strip, and the most repeated signatures and pages are found with the Signature and Path tabs; in the Attacks tab of each record, the matched section is read and the ones that are false positives are taught with Teach. When the Monitor slice of the WAF Inspection Distribution panel on the Dashboard approaches zero, the group is switched to Blocking Mode. If only one domain name is to be tested, a separate Virtual Host Group is opened for that domain name and only that group is switched to Monitor. The difference from Learning mode: since structural inspections do not run in Learning mode, false positives originating from length, method and allowed lists are seen only in Monitor mode.

Problem: The False Positives Need to Be Seen Before Switching to Blocking Mode

The rule set is ready, but before switching to Blocking mode, it is necessary to see which legitimate requests would be blocked and to clean up these records (When should I move from Learning to Monitor and from Monitor to Blocking?).

Solution: 3 Methods

Your situation	Suitable method
The whole host group will be tested	Method 1: Mode card
Only one domain name will be tested	Method 2: Separate Virtual Host Group
The mode will be changed from the command line	Method 3: WEB-CLI

Method 1: Mode Card Recommended

• How it works The host group is switched to Monitor, the records are weeded out as long as the group stays in Monitor mode, and when no false positive remains, the group is switched to Blocking. The mode change does not touch the rules.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → the mode card of the host group → Edit · the Event Logs and Dashboard tabs of the same vService
• Requirement Modify permission in the WAF area; the host group having learned the rule set in Learning mode
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the mode window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, on the mode card of the host group, Edit at the bottom right corner of the title strip is clicked (WAF Mode Edit screen).

2

Adım 2 Select Monitor mode

WAF Mode = Monitor Mode is selected.

3

Adım 3 Save

Edit in the window is clicked; no additional confirmation is asked and the change is applied without interrupting the traffic. In a cluster, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually with Synchronize.

4

Adım 4 Wait out the Monitor period

The period the group will stay in Monitor mode is kept long enough to cover all the workflows of the application (such as month-end operations and periodic campaigns).

5

Adım 5 Fetch the records

In the Event Logs tab of the same vService, the Date Range field of the server filter is selected so that it covers the period spent in Monitor mode, and Save & Get Logs is clicked (server filter).

6

Adım 6 Filter the untaught records

In the Learn Status tab of the filter strip, No and Partly are selected; the Signature tab shows the most triggered signatures at the top, and the Path tab shows the most affected pages at the top (filterable information).

7

Adım 7 Examine the records

A record is clicked; in the Attacks tab of the preview, Description highlights the matched section. In a group in Monitor mode, all the records are written with the Not blocked — Monitor mode decision (action values); the records in which only a signature whose state is Monitor was triggered are also seen with this decision, but these requests are not blocked in Blocking mode.

8

Adım 8 Teach the false positives

Only the attacks that are false positives are checked, Teach is clicked and Yes is selected in the Are you sure? window (How do I allow a request that was blocked by mistake?). Many records of the same signature are taught together by checking the rows while the signature is selected in the Signature tab and using Teach on the toolbar (Can I Allow / Teach several logs at once; are attacks hidden by the filter taught as well?).

9

Adım 9 Watch the Monitor slice

In the Dashboard tab of the vService, the Monitor slice of the WAF Inspection Distribution panel is watched (What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?).

10

Adım 10 Switch to Blocking mode

If the Monitor slice is close to zero and the new records come only from real attacks, WAF Mode = Blocking Mode is selected in the Edit window on the mode card and Edit is clicked.

Verification

1Mode cardTR7 side

The mode card of the host group is checked on the WAF Management tab.

ExpectedMonitor Mode · yellow card

2Decision of the recordsTR7 side

In Event Logs, the sentence of the Action icon of the new records is checked.

ExpectedNot blocked — Monitor mode

Method 2: Separate Virtual Host Group

• How it works The domain name to be tested is taken into its own host group and only this group runs in Monitor mode; the other domain names stay in the mode of their own groups (Can I use different modes for different domains on the same vService?).
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Virtual Host Groups band
• Requirement Modify permission in the WAF area; the domain name coming with a separate Host value
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the group window

On the WAF Management tab, the new group window is opened with the icon at the top right of the Virtual Host Groups band (How is a Host Group added; what goes into the Virtual Host Patterns field?).

2

Adım 2 Define the group

Virtual Host Group Name is entered, WAF Mode = Monitor Mode is selected and the domain name is written in the Virtual Host Patterns field (e.g. shop.example.com).

3

Adım 3 Save

Add is clicked.

4

Adım 4 Move the rule set (if needed)

The new group does not take the rules of another group; it starts with the default rule set. If the learned rules of the existing group are to be tested, Export is done on the Page Types screen of the source group and Import on that of the new group (Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?).

5

Adım 5 Weed out and switch

Steps 4–10 of Method 1 are applied for this group.

Verification

1Group recordTR7 side

In the Event Logs record of a request that comes to the domain name, the Host Group row in the Request & Location tab of the preview is checked.

ExpectedName of the new group · Not blocked — Monitor mode

Method 3: WEB-CLI

• How it works The mode of the host group is changed with the --mode field of the waf host-groups update command (optional fields).
• Where it is opened TR7 WEB-CLI
• Requirement WEB-CLI access and modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Find the group ID

The host groups of the vService and their IDs are listed:

waf host-groups list poolId <vService>

2

Adım 2 Change the mode

The mode of the group is set to Monitor:

waf host-groups update poolId <vService> id <group-id> --mode monitor

When the Monitor period ends, the same command is run with --mode blocking. The weeding out of the records is done from the interface as in steps 5–9 of Method 1.

Verification

1Group recordTR7 side

The group record is displayed.

Command: waf host-groups show poolId <vService> <group-id>

Expectedmonitor in the mode field

Common Mistakes

• Keeping the Monitor period short. Periodic flows that do not run while the group is in Monitor mode do not fall into the records and are blocked in Blocking mode.
• Taking the records of a signature whose state is Monitor for false positives. In a group in Monitor mode, these records are also seen with the Not blocked — Monitor mode decision; the request is not blocked in Blocking mode either, and in Blocking mode the same record is written with the Not blocked — Below the blocking threshold decision.
• Switching from Learning mode directly to Blocking. Since structural inspections do not run in Learning mode, the false positives of these inspections are seen for the first time in live traffic (recommended life cycle).
• Confusing the Monitor mode of the host group with the Monitor state of the signature. The mode of the group affects all requests, and the state of the signature affects only that signature (How do I try a new signature in production without risk (Monitor state)?).

How it is done in the documentation

• WAF Mode · Monitor Mode
• WAF Mode · Recommended Life Cycle
• Event Logs · Operational Best Practices

Related questions

• When should I move from Learning to Monitor and from Monitor to Blocking?
• How do I try a new signature in production without risk (Monitor state)?
• In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?