Can I Allow / Teach several logs at once; are attacks hidden by the filter taught as well?

Short answer

Yes. On the WAF Event Logs screen, as many records as wanted are selected with the boxes at the beginning of the rows and the Allow / Teach button on the toolbar is clicked; the name of the button becomes Allow, Teach or Allow / Teach according to the selection, and all the selected records are taught with a single Are you sure? confirmation. On the Global WAF Event Log screen, the records of different vServices can be selected together; the teaching is applied in turn per vService and a separate confirmation is asked for each vService. Attacks hidden by the filter are not taught: the teaching is done over the visible state of the list. The attack-based tabs of the filter strip (Signature, Scope, Category, OWASP Web, OWASP API, CWE, CAPEC, MITRE ATT&CK, Target, Severity) and the taxonomy, severity, scope and signature conditions of the Log Filter in the server filter narrow the attack list of the record; only the attacks that match the selection are taught, and the attacks of the same request that stay outside are not touched. Record-based tabs (such as Client IP, Path, Country) do not narrow the attack list; the records filtered with these tabs are taught with all their attacks. The safest way of teaching a certain signature in a large number of records is to first select that signature in the Signature tab. Only the records fetched from the server are taught; the records that stay outside Date Range and Line Limit are not processed.

Problem: The Same False Positive in Hundreds of Records

The same signature has produced false positives in a large number of records (How do I find a signature that produces too many false positives?). Instead of teaching the records one by one, a collective operation needs to be done, but the real attacks in the same requests must not be taught.

Solution: 2 Methods

Your situation	Suitable method
The records belong to a single vService	Method 1: Collective selection in Event Logs
The records belong to more than one vService	Method 2: Global WAF Event Log

If only some of the attacks of a single record are to be taught, the attacks are checked separately in the Attacks tab of the record (How do I allow a request that was blocked by mistake?).

Method 1: Collective Selection in Event Logs Recommended

• How it works The visible attacks of the selected records are taught in a single call; the records in the same call are processed in turn, and the same change to the same rule is written once.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → Event Logs tab
• Requirement Modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Event Logs screen

The Left Monitor Panel → WAF-Protected vServices → vService → Event Logs tab is opened.

2

Adım 2 Fetch the records

In the server filter, Date Range is selected; if the records of the period exceed the Line Limit value (default 1,000), the limit is increased or a signature condition is added to the Log Filter. Save & Get Logs is clicked.

3

Adım 3 Select the signature

In the Signature tab of the filter strip, the signature to be taught is selected; the other attacks of the records leave the view and the teaching scope (combining of the selections). If needed, the page is also narrowed with the Path tab.

4

Adım 4 Show all records on a single page

Page Size = All below the table is selected.

5

Adım 5 Select the records

The boxes of the rows to be taught are checked, or all rows are checked with the box in the header.

6

Adım 6 Teach

The button on the toolbar (Allow, Teach or Allow / Teach) is clicked and Yes is selected in the Are you sure? window. While the operation is in progress, the button is disabled. In a cluster, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually with Synchronize.

Verification

1Attacks columnTR7 side

The Signature selection is removed and the Attacks column of the taught rows is checked; when the pointer is moved over it, the … of … would still be blocked by today's rules tooltip appears.

ExpectedOnly the taught signature drops · the other attacks stay open

Method 2: Global WAF Event Log

• How it works The records of different vServices are selected together; the teaching is grouped per vService, each vService writes to its own rule set and a separate confirmation is asked for each of them.
• Where it is opened The TR7 logo at the bottom left → Configuration Menu → WAF → Global WAF Event Log
• Requirement Modify permission in the WAF area and an unrestricted vService scope
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the screen

The Configuration Menu is opened with the TR7 logo at the bottom left; WAF → Global WAF Event Log is selected.

2

Adım 2 Fetch the records

In the server filter, Date Range is selected, if needed the vServices are narrowed with Pick vServices in the vService field, and Save & Get Logs is clicked. The default row limit is 5,000.

3

Adım 3 Select the signature

In the Signature tab of the filter strip, the signature is selected.

4

Adım 4 Select the records

The rows to be taught are checked. The vService column shows the vService each row belongs to.

5

Adım 5 Teach

The button on the toolbar (Allow, Teach or Allow / Teach) is clicked; Yes is selected in the Are you sure? window that opens for each vService.

Verification

1Attacks columnTR7 side

The Attacks column of the taught rows is checked.

ExpectedThe taught signature drops in the rows of each vService

Common Mistakes

• Narrowing with a record-based tab and assuming only one signature will be taught. A Path or Client IP selection does not narrow the attacks; all the attacks of the records are taught.
• Assuming the right-click menu will teach the selected rows. Right-click teaches only the clicked row (right-click menu).
• Assuming all records of the period were taught while Line Limit is full. Only the fetched records are processed; the records that stay outside the limit are checked separately with Learn Status = No after the records are fetched again following the teaching.
• Expecting a single confirmation on the global screen. A separate confirmation is asked for each vService; if a confirmation is declined, nothing is written to that vService.
• Not examining sample records before collective teaching. If the record of a real attack also got into the selection, that attack is taught as well (How do I assess whether a false positive fix creates a security gap?).

How it is done in the documentation

• Event Logs · Allow / Teach
• Event Logs · The Combining of the Selections
• Global WAF Event Log · Operations

Related questions

• How do I find a signature that produces too many false positives?
• How do I filter logs by fields such as IP, country, ASN, path, signature, category, OWASP and CWE?
• Can I write advanced filters in Event Logs with AND/OR, NOT, regex and JSONata expressions?