What is the risk of staying in Monitor mode; is there a time limit for Monitor mode?

Short answer

In Monitor Mode, the WAF provides no protection: real attacks whose score reaches the threshold are also passed to the Backend Service and are only written to Event Logs. The product has no time limit for Monitor mode and no automatic switch to Blocking; the Virtual Host Group stays in Monitor until it is changed manually. For this reason, Monitor is used as the observation stage before moving to Blocking; it is kept long enough to cover the normal traffic cycle of the site, and the move to Blocking is made once it is seen that no new false positives arrive in Event Logs. During the Monitor period, the Block Threshold (per sec) notification is not triggered; the attack intensity is monitored with the Detected Attack Threshold (per sec) notification, the WAF Detected Attack Requests panel on the Dashboard and in Event Logs.

Risks

Risk	Description
No protection	Attacks whose score reaches the threshold reach the Backend Service; Blacklist Protection and Frontend Blacklist matches are also only recorded
No time limit	The group does not switch to Blocking Mode on its own; it stays in Monitor until the mode card is changed
Notifications	Block Threshold (per sec) counts only blocked requests and is not triggered in Monitor mode; Detected Attack Threshold (per sec) counts the attacks that are blocked, the ones passed in Monitor and the ones that arrive with the Teacher identity together
Dashboard	The requests of the group in Monitor mode do not enter the WAF Blocked Requests panel; these attacks are seen in the WAF Detected Attack Requests panel and in the Monitor series of the WAF Inspection Distribution panel
Record volume	Every request whose score reaches the threshold is written to Event Logs; WAF Log Suppression Condition only hides the records from the list and does not prevent them from being written

• Mature domain names do not have to be kept in Monitor: only the new or changing domain name can be kept in Monitor in a separate Virtual Host Group, while the others are left in Blocking (Can I use different modes for different domains on the same vService?).
• If a single signature causes problems, instead of keeping the whole group in Monitor, only the State value of that signature is set to Monitor (How do I try a new signature in production without risk (Monitor state)?).
• Switching criteria and steps: When should I move from Learning to Monitor and from Monitor to Blocking?

Common Misconceptions

• "Monitor mode is a light form of protection." In Monitor Mode, the WAF blocks no requests at all; attacks are also passed to the Backend Service.
• "There is a safe number of days for Monitor." No numerical duration is defined in the product; the duration depends on the traffic cycle of the site and on the clearing of the false positives in Event Logs.
• "If no blocking notification arrives, there is no attack." Since there is no blocking in Monitor mode, Block Threshold (per sec) is never triggered.

How it is done in the documentation

• WAF Mode · Monitor Mode
• Dashboard · WAF Detected Attack Requests
• Notifications · Detected Attack Threshold (per sec)
• Event Logs · Operational Best Practices

Related questions

• What does the WAF do in Monitor mode?
• When should I move from Learning to Monitor and from Monitor to Blocking?
• Can I receive a notification when the attack count exceeds a certain threshold?