Operating Modes

The behavior of the Learning, Monitor and Blocking modes and the transitions between them.

• What are the WAF operating modes?WAF-03-001
• What does the WAF do in Learning mode; are attacks blocked?WAF-03-002
• What does the WAF do in Monitor mode?WAF-03-003
• What does the WAF do in Blocking mode?WAF-03-004
• In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?WAF-03-005
• When should I move from Learning to Monitor and from Monitor to Blocking?WAF-03-006
• Can I use different modes for different domains on the same vService?WAF-03-007
• What is the risk of staying in Monitor mode; is there a time limit for Monitor mode?WAF-03-008
• Can I still keep learning certain traffic while in Blocking mode (Conditional Learning)?WAF-03-009
• If the application changes after moving to Blocking, should I go back to Learning mode?WAF-03-010
• Can a request be blocked with 418 even in Learning or Monitor mode?WAF-03-011
• Can I enable TR7 WAF directly in Blocking mode without using Learning mode?WAF-03-012