Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How do I find a signature that produces too many false positives?
Short answer
On the WAF Event Logs screen, the Signature tab of the filter strip lists, from most to fewest, in how many attacks each signature occurs in the fetched records (filterable information). The signature at the top of the list is selected and, with No and Partly in the Learn Status tab, the view is narrowed to the records not taught; then the distribution in the Client IP, Country, ASN and Path tabs is read. If the records come from a large number of different clients, from the known networks of the organization and from the same few pages, the signature is most likely producing false positives; if they spread from a few addresses to a large number of different paths, it is an attack scan. The definitive decision is made with the Description in the Attacks tab of each record. The same examination is done for all vServices on the Global WAF Event Log screen. For the totals of longer periods, the Attack ID breakdown in the Attacks view of the WAF Report is used. If AI Learning is on, the AI Learning Tracking view lists the exclusion candidates seen widely from different clients, countries and networks. The Dashboard panels give a breakdown not at the signature level, but at the category and OWASP item level.
Problem: It Is Not Known Which Signature Causes the Problem
A large number of blocking reports are coming from users. It must be found which signature produces most of these records and whether the signature catches real attacks or legitimate traffic.
Solution: 4 Methods
| Your situation | Suitable method |
|---|---|
| A single vService is being examined | Method 1: Event Logs filter strip |
| The effect of the signature on all vServices is to be measured | Method 2: Global WAF Event Log |
| Totals over days or weeks are needed | Method 3: WAF Report |
| AI Learning is on; the widespread candidates are wanted to be seen | Method 4: AI Learning Tracking |
Method 1: Event Logs Filter Strip Recommended
- How it works The filter strip counts the fetched records by tab; a selection made in one tab recalculates the numbers of the other tabs (combining of the selections). The Signature tab shows the number of attacks, and tabs such as Client IP and Path show the number of records.
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → Event Logs tab
- Requirement WAF permission; the host group in Monitor or Blocking mode (in Learning mode, no Event Logs record is created)
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Open the Event Logs screen
The Left Monitor Panel → WAF-Protected vServices → vService → Event Logs tab is opened.
2
Adım 2 Fetch the records
In the server filter, Date Range is selected so as to cover the period to be examined; Line Limit (default 1,000) is increased enough for the records of the period and Save & Get Logs is clicked.
3
Adım 3 Select the signature
The Signature tab of the filter strip is opened; the signatures are sorted by the number of attacks, and below each value the description of the signature is written. The signature at the very top is selected.
4
Adım 4 Narrow down to the records not taught
In the Learn Status tab, No and Partly are selected.
5
Adım 5 Read the distribution
The Client IP (how many different clients), Country, ASN and Path tabs are checked. A large number of different clients, the known networks of the organization and a few pages point to a false positive; a few addresses and a large number of different paths point to an attack.
6
Adım 6 Verify the records
A few records are clicked; in the Attacks tab of the preview, Description highlights in which section of the request the signature matched. If the matching section is the application's own data, the signature is producing false positives.
7
Adım 7 Fix
With the Signature selection kept, the records are checked and only this signature is taught with the teaching button on the toolbar (Allow, Teach or Allow / Teach according to the selection) (Can I Allow / Teach several logs at once; are attacks hidden by the filter taught as well?), or the state of the signature is set to Monitor on the vService (Is it better to disable a signature entirely or to add an OWASP exclusion?).
The same narrowing can also be done on the server side: in the Log Filter field of the server filter, a Signature condition from the Taxonomy group and a Learn status condition from the WAF group are added; this way, the row limit is spent only on the records of this signature (How do I filter logs by fields such as IP, country, ASN, path, signature, category, OWASP and CWE?).
Verification
1Signature tabTR7 side
After the teaching or the state change, the records are fetched again for the same period and the Signature tab is checked while Learn Status = No is selected.
Expected
The signature drops from the top of the listMethod 2: Global WAF Event Log
- How it works The same filter strip counts the records of all WAF-protected vServices together; the vService tab shows in which applications the signature is triggered.
- Where it is opened The TR7 logo at the bottom left → Configuration Menu → WAF → Global WAF Event Log
- Requirement WAF permission and unrestricted vService scope
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Open the screen
The Configuration Menu is opened with the TR7 logo at the bottom left; WAF → Global WAF Event Log is selected.
2
Adım 2 Fetch the records
In the server filter, Date Range is selected and Save & Get Logs is clicked. The default row limit is 5,000.
3
Adım 3 Read the signature and the distribution
In the Signature tab, the signature is selected; the distribution of the vService, Client IP and Path tabs is read. If the row limit is full, the numbers are not the total of the period but a sample made up of the newest records.
Verification
1vService tabTR7 side
While the signature is selected, the vService tab is checked.
Expected
The vServices in which the signature is triggered and their record countsMethod 3: WAF Report
- How it works The report is produced from the WAF records of the selected period; the Attacks view breaks the attacks down by Attack ID, rule and scope, argument and risk level. With Report Filter, a report is produced only from certain records.
- Where it is opened The For Detailed Analysis → WAF Report shortcut on the vService Dashboard tab, or the Generate Report link of the Periodic Reporting card on the WAF Management tab (how to access)
- Requirement WAF permission
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Open the WAF Report tab
The For Detailed Analysis → WAF Report shortcut on the vService's Dashboard tab is clicked.
2
Adım 2 Open the report form
The Generate Report button on the tab is clicked.
3
Adım 3 Select the period and the filter
Report Type = html is left as it is, and the period to be examined is selected in the Date field. If only certain records are to be examined, Report Filter = Select is selected and the condition is defined (Can I produce a report containing only certain attacks with the report filter?).
4
Adım 4 Generate the report
Accept is clicked; the report is produced in the same request and opens in the tab.
5
Adım 5 Read the signature breakdown
The Attack ID breakdown is read in the Attacks view of the report; if there is more than one host group, they are examined group by group with the host group selection on the report.
Verification
1Attacks viewTR7 side
The Attack ID table in the Attacks view of the report is checked.
Expected
The signatures with their attack counts within the periodMethod 4: AI Learning Tracking
- How it works The AI Learning Tracking view reruns the AI Learning calculation with live data without writing anything to the rule set; it lists, with Learning Progress, the exclusion candidates that are seen widely from different clients, countries and networks and are approaching being learned; these candidates are often the signatures that produce false positives (AI Learning & Teacher Tracking).
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → AI Learning Tracking tab (if Teacher is also on, the name of the tab becomes AI Learning & Teacher Tracking)
- Requirement WAF permission; AI Learning on in the Learning Methods window
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Open the view
On the vService's AI Learning Tracking tab, AI Learning Tracking is selected from the view list at the top left.
2
Adım 2 List only the signatures
In the type list on the toolbar (default All), OWASP is selected (Type Filter).
3
Adım 3 Lower the threshold (if needed)
In the strip opened with the Advanced Settings link on the toolbar, the Min Progress (%) value (default 50) is lowered; candidates that have not matured yet also appear (What are the Min Progress (%), Max Suggestions and Line Limit advanced settings for?). This value affects only the view; it does not change the learning thresholds.
4
Adım 4 Refresh the view
Refresh is clicked; the candidates are listed with Learning Progress. When a row is clicked, the list of the clients that feed the suggestion appears in the preview.
Verification
1Suggestion previewTR7 side
The client table in the preview of the selected suggestion is checked.
Expected
A large number of different clientsIf the suggestion is fed from a single client, it may reflect not a general usage pattern but the behavior of that client.
Common Mistakes
- Looking only at the count. The most triggered signature can also indicate a real attack wave; the source and path distribution are read together.
- Overlooking the row limit. If Line Limit is full, the tab counts are a sample made up of the newest records; Date Range is narrowed or the server filter is used.
- Looking for signatures on the Dashboard. The Dashboard panels stay at the category and OWASP item level (Detected Attacks by Category).
- Expecting records in a host group in Learning mode. In Learning mode, no Event Logs record is created; the effect of a signature is measured in Monitor or Blocking mode.
How it is done in the documentation
