Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
False positives increased after an application update; what should I do?
Short answer
The host group is not put into Learning mode as a whole; first the source of the increase is isolated on the WAF Event Logs screen. In the filter strip, Learn Status = No is selected for the period after the update and the Path, Category and Signature tabs are checked: the Structure Limits and Structure Policies categories show that new or changed pages exceed the learned limits (allowed methods, allowed parameters, lengths), and the signature categories show that the new content matches signatures. If a small number of pages are affected, the records are taught collectively with the Allow / Teach button through the Path selection (the name of the button becomes Allow, Teach or Allow / Teach according to the selection); when needed, the teaching opens a rule for the new page (New rule will be created). If the change is large, a Conditional Learning identity is given to the test team, the new version is browsed without being blocked and Analysis & Learning is run with Combine with Old Rules; in the result, only the paths for which rules will be created are left, unknown or suspicious paths are excluded from the analysis with Exclude from Analysis and then the analysis is applied. Since applying the analysis cannot be undone, the rule set is first backed up with Export. If the test team will teach the rule set itself, Teacher is turned on. If the new section is published on a separate domain name, a Virtual Host Group is opened only for that domain name and taught in Learning mode. If the blocking of legitimate users is unacceptable while the cleanup is in progress, the host group can be put into Monitor mode temporarily.
Problem: False Positives Increased After the New Version
After the application was updated, blocks started on new or changed pages (New pages are blocked after I released a new version; what should I do?). The rule set needs to be adapted to the new version without turning off the protection.
Solution: 4 Methods
| Your situation | Suitable method |
|---|---|
| A small number of new or changed pages | Method 1: Collective Allow / Teach |
| The structure of the application changed to a large extent | Method 2: Conditional Learning + Analysis & Learning |
| The test team will browse the new version and teach the rules itself | Method 3: Teacher |
| The new section is on a separate domain name | Method 4: Separate Virtual Host Group |
Method 1: Collective Allow / Teach Recommended
- How it works The records after the update are selected page by page and taught collectively; if the matching rule is Any Paths and the Rule Creation Policy covers the field, a new rule is opened for the path of the request (Which rule changes in the background when I Allow / Teach (Learning Suggestion)?).
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → Event Logs tab
- Requirement Modify permission in the WAF area; the host group in Monitor or Blocking mode
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Fetch the records
On the Event Logs tab, the Date Range field of the server filter is selected so as to cover the period after the update and Save & Get Logs is clicked.
2
Adım 2 Filter the untaught records
In the Learn Status tab of the filter strip, No is selected.
3
Adım 3 Isolate the source
The Path tab shows the most affected pages, the Category tab the violation type, and the Signature tab the triggered signatures (filterable information).
4
Adım 4 Select and examine a page
In the Path tab, a page is selected; Description and Learning Suggestion are read in the Attacks tab of a few records.
5
Adım 5 Select the records
The boxes at the beginning of the rows of the page's records to be taught are checked.
6
Adım 6 Teach
The teaching button on the toolbar (Allow, Teach or Allow / Teach according to the selection) is clicked and Yes is selected in the Are you sure? window (Can I Allow / Teach several logs at once; are attacks hidden by the filter taught as well?). If the Learning Suggestion will remove a value pattern (will be disabled), the pattern is fixed manually instead of being taught (How do I edit the matching rule from a log with "Edit Corresponding Rule"?).
7
Adım 7 Repeat for the other pages
Steps 4–6 are repeated for the other affected pages.
Verification
1Attacks columnTR7 side
The Attacks column of the taught rows is checked.
Expected
0 / N · row pale greenMethod 2: Conditional Learning + Analysis & Learning
- How it works The requests that come with the Conditional Learning identity are not blocked and are written to the learning log; Analysis & Learning reads this log and extends the existing rule set with the pages of the new version (What is the difference between "Create New Rules" and "Combine with Old Rules" in the analysis?). The host group stays in Blocking mode; the other users continue to be protected.
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Learning Methods card · Analysis & Learning on the mode card of the host group
- Requirement Modify permission in the WAF area; a fixed IPv4 address of the test team, or a client of theirs that can add the
TR7-ANALYZEheader or cookie - vService type HTTP
Step-by-Step Configuration
1
Adım 1 Back up the rule set
On the WAF Management tab, the N page types row on the mode card of the host group is clicked and the rule set is exported with Export (Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?). Applying an analysis cannot be undone.
2
Adım 2 Open the Learning Methods window
On the WAF Management tab, the pencil icon at the top right of the Learning Methods card is clicked.
3
Adım 3 Turn on Conditional Learning
The Conditional Learning switch is turned on.
4
Adım 4 Enter the identity
The address of the test team (e.g. 198.51.100.25) is entered in the Conditional Learning IP field, or the value of the TR7-ANALYZE cookie or header is written in the Conditional Learning Cookie / Conditional Learning Header field (What is the difference between Conditional Learning and Teacher; when should I use which?).
5
Adım 5 Save
Edit in the window is clicked.
6
Adım 6 Browse the new version
The test team browses all the pages and flows of the new version with real data.
7
Adım 7 Open the analysis window
The Analysis & Learning text on the mode card of the host group is clicked; the New Analyze for <vService> window opens (creating a new analysis).
8
Adım 8 Set up the analysis
The updated group is selected in the Virtual Host Groups field, and the browsing period in the Analyze Date field. The Ignore Old Rules switch is moved from the default Create New Rules position to the Combine with Old Rules position; Rule Creating Mode is left the same as the current Rule Creation Policy (the selected value also updates the permanent policy).
9
Adım 9 Start the analysis
Start Analyzing is clicked; the progress is followed from the bar on the mode card.
10
Adım 10 Review the result
When the analysis finishes, the list of past analyses is opened with the house icon on the mode card; the analysis is selected and the produced pages are examined on the Analyze Page Types tab with Edit (Can I review and edit the analysis result before applying it (Analyze Page Types screen)?).
11
Adım 11 Exclude the suspicious paths from the analysis
The paths that come out of the analysis result are checked; only the paths for which a WAF rule will be created must remain in the list. It is recommended that unknown or suspicious paths be excluded from the analysis manually: these paths are selected in the right pane of the Analyze Page Types screen and Exclude from Analysis is clicked; the excluded paths are removed from the tree and do not produce rules.
12
Adım 12 Apply
Apply on the Analyze Page Types screen is clicked and Are you sure? is confirmed.
13
Adım 13 Turn off Conditional Learning
In the Learning Methods window, first the identity fields are emptied and saved with Edit; the window is opened again, the Conditional Learning switch is turned off and Edit is clicked. Turning it off does not delete the identities by itself, and an identity left in the fields continues to match even while the switch is off; since the fields are hidden from the form when the switch is turned off and a change in hidden fields is not saved, the emptying is done with a separate save, before the switch is turned off.
Verification
1Page TypesTR7 side
The Page Types list of the host group is checked.
Expected
Old rules preserved · pages of the new version addedMethod 3: Teacher
- How it works The requests of the test team that come with the Teacher identity are not blocked (a request whose scan exceeds the time limit is also let through); the requests that reach the blocking threshold or trigger a signature whose state is Monitor are taught to the rule set at the end of the period (How is Teacher used to reduce false positives?).
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Learning Methods card
- Requirement Modify permission in the WAF area; the host group in Monitor or Blocking mode
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Open the Learning Methods window
On the WAF Management tab, the pencil icon at the top right of the Learning Methods card is clicked.
2
Adım 2 Turn on Teacher
The Teacher switch at the end of the window is turned on.
3
Adım 3 Enter the identity
The address of the test team is entered in the Teacher IP field, or the value of the TR7-LEARN cookie or header is written in the Teacher Cookie / Teacher Header field.
4
Adım 4 Select the period
The processing period is selected from the Teaching Frequency list (e.g. 5 minutes).
5
Adım 5 Save
Edit in the window is clicked.
6
Adım 6 Browse and monitor
The test team browses the new version. On the vService's Teacher Tracking tab (named AI Learning & Teacher Tracking if AI Learning is also on), the Teacher Tracking view shows the queued learnings with Refresh, and the Teacher History view shows the applied ones.
7
Adım 7 Turn off Teacher
When the work is finished, the Teacher switch is turned off and Edit is clicked; while the switch is off, the saved Teacher identities do not match. For the identities to be deleted from the record as well, the fields are emptied with a separate save before the switch is turned off.
Verification
1Teacher HistoryTR7 side
After the period passes, the Teacher History view is checked.
Expected
Learning rows belonging to the new pagesMethod 4: Separate Virtual Host Group
- How it works The new domain name learns in its own host group in Learning mode; the other domain names continue to be protected in the mode of their own groups (Can I use different modes for different domains on the same vService?).
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Virtual Host Groups band
- Requirement Modify permission in the WAF area; the new section being published on a separate domain name (e.g.
app.example.com) - vService type HTTP
Step-by-Step Configuration
1
Adım 1 Open the group window
On the WAF Management tab, the new group window is opened with the icon at the top right of the Virtual Host Groups band (How is a Host Group added; what goes into the Virtual Host Patterns field?).
2
Adım 2 Define the group
Virtual Host Group Name is entered, WAF Mode = Learning Mode is selected and the new domain name is written in the Virtual Host Patterns field.
3
Adım 3 Save
Add is clicked. The new group does not take the rules of another group; it starts with the default rule set and learns from scratch.
Verification
1Mode cardTR7 side
On the WAF Management tab, the mode card of the new group is checked.
Expected
Learning Mode · blue cardCommon Mistakes
- Putting the host group into Learning mode as a whole. In Learning mode, blocking and structural inspections stop; the whole protection is removed just for the sake of the new pages.
- Running the analysis with Create New Rules. The existing rule list is ignored and the rule set is rebuilt only from the browsing traffic; in an update, Combine with Old Rules is selected.
- Applying an analysis without taking an Export. Applying an analysis cannot be undone; Allow / Teach and Teacher learnings, on the other hand, can be undone with Revert Learning.
- Forgetting Conditional Learning on. The requests that carry the identity continue to pass without being blocked; the signature scan continues but there is no blocking. Turning off only the switch is not enough; the identity fields are also emptied with a separate save before the switch is turned off.
- Continuing to block users while the cleanup is in progress. If the blocks are unacceptable, the host group is put into Monitor mode temporarily and, when the records are cleaned up, it is returned to Blocking mode (How do I use Monitor mode to weed out false positives?).
- Teaching the next version on live again. The new version can be taught on a test vService before release and the rule set can be moved with Page Types Export / Import; Import replaces the whole rule set of the target group (What happens to existing rules when I Import (full replacement)?).
How it is done in the documentation
