What exactly does the WAF Time value measure?

Short answer

WAF Time is the CPU time that the WAF inspection spent for that request; it is in milliseconds and is kept with microsecond precision, with three decimals. The measurement starts when the WAF inspection starts and ends when the final score of the request is calculated, before the record is written. The work it covers is the normalization of the path, host group and rule matching, the parsing of the body (JSON, XML, form), the signature scanning in all inspection fields, the structural checks and the scoring. The times it does not cover: the whitelist decision given before entering the WAF, waiting for the body to arrive from the client, writing the Event Logs record, generating the blocking response, the response time of the Backend Service and the network latency. Since the value is CPU time and not wall-clock time, waits are not counted; at busy moments, other requests processed at the same time can increase the value. The value is seen only in requests for which an Event Logs record is written, on the Request & Location tab of the record preview.

How Does It Work?

Included in the time	Not included in the time
Normalization of the path, host group and rule matching	Whitelist Condition and the static content exemption (these requests never enter the WAF)
Parsing of the body (JSON, XML, form)	Waiting for the body to arrive from the client (Wait for body for a time)
Signature scanning in all inspection fields	Writing the Event Logs record
Structure Checks and Argument Checks	Generating the blocking response
Calculation of the attack score	Response time of the Backend Service and network latency

• Factors that increase the time: large or deeply structured bodies (Max. Body Size to Process(kB) determines how much of the body is processed), a large number of parameters, and OWASP Protection Level, which enables more signatures.
• In Blocking mode, for a request that is blocked because its scan could not be completed within the time limit, the wafTime value in the attack information sent to the SIEM is a fixed 2000. This is not a measurement but a marker of the timeout; this request is not written to Event Logs (What happens to a request if the scan exceeds a certain time (2-second scan limit)?). In Learning or Monitor mode, in a Teacher or Conditional Learning request and while Fail-open is on, these requests are let through and the attack information stays empty ({}).

Where Is It Seen?

Place	Display
Event Logs → preview → Request & Location	WAF Time row
WAF Report → Traffic	WAF Time distribution: <0.1ms, 0.1ms-0.5ms, 0.5ms-1ms, 1-10ms, 10-100ms, 100-1000ms, >1s
SIEM (CEF Format, TR7 JSON Format, TR7 WAF Log)	wafTime key

Steps: Can I see how long a request spent in the WAF (WAF Time)?

Common Misconceptions

• "WAF Time is the additional time the user waits." The value is only the CPU time of the WAF inspection; waiting for the body, the Backend Service response and the network latency are not included. Monitoring the overall load of the WAF: How do I measure the time the WAF adds to a request; for which requests is it visible?
• "The WAF time of clean requests is also seen." The time is kept only in requests for which an Event Logs record is written.
• "The value 2000 is a slow two-second scan." This fixed value is the marker of a request whose scan was cut off at the time limit and which was blocked.

How it is done in the documentation

• CEF · WAF Info Structure
• Event Logs · Request & Location Tab
• WAF Report · The HTML Report

Related questions

• Can I see how long a request spent in the WAF (WAF Time)?
• How do I measure the time the WAF adds to a request; for which requests is it visible?
• Does the WAF slow down my site?