Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How are the Severity levels (Blacklist, Structural, Very High … Very Low) determined?
Short answer
Severity is derived from the highest single attack score among the attacks in the record; not from the total score of the request. Thresholds: 50 and above Blacklist, 10 and above Structural, 8 and above Very High, 6 and above High, 4 and above Medium, 2 and above Low, below 2 Very Low. Since built-in signatures carry 2, 4, 6, 8 or 9 points, structural check violations 24 points and a blacklist hit 100 points, Structural indicates a structural check violation and Blacklist indicates a blacklist hit. The Severity column is hidden by default and is turned on with Columns; the Severity tab in the filter strip and the WAF · Severity field in Log Filter work on a per-attack basis. The same level is written in parentheses next to the signature name on the Attacks tab of the preview, and is sent to SIEM if Severity is selected in the Attack Details in WAF Info field.
Thresholds
| Highest single attack score | Severity | Typical source |
|---|---|---|
| ≥ 50 | Blacklist | The source IP being in the blacklist (100 points) |
| ≥ 10 | Structural | Structure Checks violation (24 points) |
| ≥ 8 | Very High | 8- or 9-point signature |
| ≥ 6 | High | 6-point signature |
| ≥ 4 | Medium | 4-point signature |
| ≥ 2 | Low | 2-point signature |
| < 2 | Very Low | A score below 2; since the signature score is selected in the interface as 2, 4, 6 or 8, it does not occur in built-in and custom signatures |
- If a record has more than one attack, the column shows the level of the attack with the highest score; the column is sorted by this score.
- Severity is for information; whether the request is blocked or not is decided by comparing the total score with the blocking threshold (What is the attack score and how is it calculated?).
- Changing the score of a signature also changes its level: Can I change a signature's score (Low / Medium / High / Very High)?
Where Is It Used?
| Place | Behavior |
|---|---|
| The Severity column in the table | Hidden by default; it is turned on with Columns, and the value is written in the color of the level (Which Event Logs columns are hidden by default; how do I show them?) |
| Filter strip → Severity | Per-attack, multiple selection: attacks that do not match the selection are removed from the record, and a record with no attack left drops out of the list |
| Log Filter → WAF · Severity | Filters on the server side with the Includes Any of, Includes None of and Exists operators |
| Preview → Attacks | In parentheses next to the signature name in the Attack Name row (e.g. (Very high)) |
| SIEM | If Severity is selected in the Attack Details in WAF Info field, in the severity key of every attack, in the language of WAF Info Language (Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?) |
Common Misconceptions
- "Severity is determined by the total score." It is determined by the highest score of a single attack in the record; a request blocked by many low-score signatures may appear as Medium.
- "Very Low attacks are not blocked." The blocking decision is made by the total score; low-level attacks are also added to the total score (except for signatures in Monitor state).
- "Structural is a signature category." Structural is an attack with a score of 10 or above; since built-in signatures carry at most 9 points, in practice it indicates a structural check violation.
How it is done in the documentation
