What does the WAF do in Monitor mode?

Short answer

In Monitor Mode, the WAF performs the same inspection as in Blocking mode: the signature scan, the structural and field inspections and the scoring are complete, and the blocking decision is also calculated but not applied. A request whose score reaches the threshold is passed to the Backend Service and is written to Event Logs with all the attack details, with the Not blocked — Monitor mode decision; it is counted in the Monitor series in the WAF Inspection Distribution panel on the Dashboard. In this mode, the rule set runs on real traffic without blocking and its results are monitored; false positives are taught from Event Logs with Allow / Teach. Monitor mode does not provide protection; in this mode, the WAF does not block any request based on the attack score.

In Monitor Mode

Request	Result	Event Logs (Action)	WAF Inspection Distribution
Score ≥ threshold	Let through	Not blocked — Monitor mode	Monitor
Score < threshold, but a signature with State = Monitor matched	Let through	Not blocked — Monitor mode	Clean
Score < threshold, only Enabled signatures matched	Let through	No record	Clean
Teacher identity, score ≥ threshold	Let through	Not blocked — Teacher IP matched (Teacher cookie or Teacher header, depending on the identity)	Teacher
Conditional Learning identity	Processed as in Learning mode, let through	No record	Learning
Its scan cannot be completed within the 2-second time limit	Let through (blocked if the scan was cut off while the rules were being loaded and before the host group was determined, and the vService has a group in Blocking mode)	No record	Not shown

• A request whose scan cannot be completed within the 2-second time limit is passed to the Backend Service in Monitor mode and leaves no WAF record (the only exception is the scan being cut off while the WAF rules are being loaded and before the host group is determined: if the vService has a group in Blocking mode, this request is blocked (WAF Mode · Blocking Mode)); even if Debug Mode is on for the vService, the WAF decision does not appear in the Debug Mode Logs record. The same request is blocked in a group in Blocking Mode; this blocked request is not written to Event Logs either, and if Debug mode is on, it appears in Debug Mode Logs with the Attack blocked — scan timed out decision. If Fail-open in the Request Body Limits window is on, it is let through in Blocking mode as well (What happens to a request if the scan exceeds a certain time (2-second scan limit)?).
• The score and the threshold are calculated with the same rules as in Blocking mode: the threshold is the OWASP Protection Level value of the vService (default Very tight, 4) (How does TR7 WAF decide whether to block a request?).
• The WAF Blocked Requests panel on the Dashboard does not increase in this mode; the requests that reach the threshold are counted in the WAF Detected Attack Requests panel.
• In notifications, Block Threshold (per sec) counts only the blocked requests; for the attack density in Monitor mode, Detected Attack Threshold (per sec) is used.
• Examining the records: operational best practices · I am blocking legitimate users by mistake; how do I find out?

Common Misconceptions

• "The inspection is lighter in Monitor mode." The inspection is exactly the same as in Blocking Mode; only the blocking is not applied.
• "Monitor mode and the Monitor state of a signature are the same." The State value of a signature affects only that signature; the mode affects the whole Virtual Host Group.
• "Every Monitor mode record in Event Logs is a request that will be blocked in Blocking." In Monitor mode, the below-threshold matches of a signature whose State = Monitor are also written with the same decision; these requests are not blocked in Blocking mode either. These records are separated in Event Logs with the Monitor Only field of the Log Filter; if Debug Mode is on for the vService, they also appear as Not blocked — Below the blocking threshold in the Verdict row of the WAF box in the Debug Mode Logs preview.
• "Attacks are blocked in Monitor mode." Attacks pass (What is the risk of staying in Monitor mode; is there a time limit for Monitor mode?).

How it is done in the documentation

• WAF Mode · Monitor Mode
• Event Logs · The Action Values
• Event Logs · Operational Best Practices
• Dashboard · WAF Inspection Distribution

Related questions

• What is the risk of staying in Monitor mode; is there a time limit for Monitor mode?
• What does the WAF do in Blocking mode?
• I am blocking legitimate users by mistake; how do I find out?