Which stages does a request go through inside TR7 WAF?

Short answer

The request first goes through the exemption: while Do not WAF static contents is on (default), static content requests and requests that match the Whitelist Condition never enter the WAF and are counted as Whitelisted. For a request that enters the WAF, if Blacklist Protection is on, the source IP is queried against the blacklists and the Frontend Blacklist (a hit is written as 100 points), the Conditional Learning and Teacher identities are recognized, and then the Virtual Host Group and the WAF Mode of the group are determined according to the Host header, and the Page Types rule according to the path (how it works). Then the path, query, header and body go through both signature scanning and the structural inspections; all violations are summed in a single attack score, and no decision is made before the scanning finishes. At the end of the scanning, the score is compared with the OWASP Protection Level threshold; if the group is in the Blocking mode, a request that reaches the threshold is blocked, in the Monitor mode it is recorded and let through, a Teacher request is let through, and in the Learning mode and with the Conditional learning identity the request is written to the learning record. If the scanning cannot be completed within the 2-second time limit, the request is blocked in the Blocking mode (let through if Fail-open is on), and in the other modes it is let through, except for an exception that can occur while the rules are being loaded.

How Does It Work?

#	Stage	What happens
1	Exemption	Do not WAF static contents (static file extension + GET + no query + no body), Whitelist Condition, AGS authentication traffic, Advanced CAPTCHA verification requests and the client proof request that the Bot/DDoS verification page sends to the product do not enter the WAF; they are counted as Whitelisted (Which requests are treated as "static content" and excluded from WAF inspection (extension, method, query and body conditions); is this safe?)
2	Blacklist	If Blacklist Protection is on (default), the source IP is searched for in the selected Blacklist IP Category lists and in the Frontend Blacklist; an address in the Frontend Blacklist Exclusions is not counted. A hit is written as 100 points; the scanning continues
3	Learning methods	A request that comes with the Conditional Learning identity (IP, TR7-ANALYZE header or cookie) is processed as if it were in the Learning mode, independently of the mode of the group. A request that comes with the Teacher identity (IP, TR7-LEARN header or cookie) is inspected but not blocked
4	Virtual Host Group	The Host header of the request is matched with the Virtual Host Patterns of the groups; if there is no Host header, the target IP:port is used, and if no group matches, the default group is selected. The WAF Mode of the group is determined here
5	Page types	If there is a rule that matches the path exactly (exact), that rule is used; if not, all glob rules that match the path are combined with Any Paths; if none matches, only Any paths is applied (runtime rule matching)
6	Section inspections	The path, query, header and body (JSON, XML, form-urlencoded, multipart, raw) are inspected in order; every section goes through signature scanning and the Check Fields structural inspections. In the Learning mode, the path, header and field structure inspections do not work and the body inspections do not enter the score
7	Score and threshold	The scanning does not stop at the first violation; all violations are summed, and when the scanning finishes the total is compared with the OWASP Protection Level threshold (If a request contains several attacks, does the WAF stop at the first match or evaluate all of them?)
8	Decision	In the Blocking mode, a request that reaches the threshold is answered with the Blocking Status Code (default 418) and the blocking page; in the Monitor mode it is recorded and forwarded to the Backend Service; a Teacher request is forwarded; in Learning it is written to the learning record (Which decisions does the WAF make for a request; what do Action in Event Logs and Verdict in Debug Mode Logs mean?)

The duration of the scanning is limited to 2 seconds; waiting for the body to arrive from the network does not count toward this duration. A scanning that cannot be completed within the duration is terminated: if the group is in the Blocking mode, the request is blocked so that an uninspected request does not reach the Backend Service, and if Fail-open in the Request Body Limits window is on, it is let through without being scanned; in the Learning and Monitor modes and for a request that comes with the Teacher or Conditional Learning identity, on the other hand, the request is let through (the only exception is the scanning being terminated while the WAF rules are being loaded and before the host group is determined: if the vService has a group in Blocking mode, a request that comes to a group in the Learning or Monitor mode is also blocked; Teacher and Conditional Learning requests are outside this exception (WAF Mode · Blocking Mode); What happens to a request if the scan exceeds a certain time (2-second scan limit)?).

Where Is It Monitored?

• The flow diagram on the right of the vService Dashboard screen summarizes the same chain with the W/B List → Learning methods → Virtual host groups → OWASP → Checks cards (WAF section of the flow diagram); this order is a visual summary, and signature scanning and the structural inspections are carried out together in every request section.
• The result with which each request came out is seen in the WAF Inspection Distribution chart with the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning series.
• The place of the WAF in the TR7 request chain: Which stages does a request go through inside TR7 before it reaches the backend?

Common Misconceptions

• "An address in the blacklist is blocked without being inspected." The hit is written as 100 points, the scanning continues and the decision is made at the end of the scanning according to the mode; in the Learning mode or with the Teacher identity, the request is not blocked (violation scores).
• "The scanning stops at the first violation." The request is scanned to the end; all hits are listed in the same record.
• "The static content exemption looks at the extension." In addition to the extension, the method must also be GET and there must be no query and no body; a request such as /logo.png?id=1 is inspected (Do not WAF static contents).

How it is done in the documentation

• WAF - WAAP · How Does It Work?
• Dashboard · The Flow Diagram: The WAF Section
• WAF Rules · Runtime: Rule Matching
• Whitelist & Blacklist · What Is Whitelist & Blacklist?

Related questions

• Which stages does a request go through inside TR7 before it reaches the backend?
• How does TR7 WAF decide whether to block a request?
• Which decisions does the WAF make for a request; what do Action in Event Logs and Verdict in Debug Mode Logs mean?