How is a request that matches no page type inspected?

Short answer

It is not left uninspected: it is inspected with the Any Paths rule of the host group the request falls into (runtime rule matching). In the default configuration, this means that the method is compared with the GET, OPTIONS, HEAD, POST, PUT, PATCH and DELETE list and the path with the limit of a length of 1–8192 and a depth of at most 256, that the path and the Query, Header, JSON, Xml, Form and Raw sections go through signature scanning, and that the Check Fields checks of Any paths (including the default header rules) are applied. In Learning mode, the structural checks do not block the request and are not added to the score; in addition, Path length and Path depth are applied while Structure Checks is on. For such a request, Any paths is written in the Corresponding Rule row of the Event Logs record. For unknown paths to be inspected more strictly, the settings of Any paths are tightened with Edit; this affects all the paths that do not have their own rule.

How Does It Work?

1. The request falls into a host group according to the Host header; if no group's pattern matches, it falls into the default host group (Which host group does a request fall into; what if it matches none?).
2. The path is compared with the exact and glob rules of the group; when none of them matches, the Any paths rule of the group is selected.
3. The path settings and the Check fields checks of Any paths are applied; the violations are added to the attack score.
4. The WAF Mode setting of the group determines the result: in Blocking, a request that reaches the threshold is blocked; in Monitor, it is recorded without being blocked; in Learning, the request is not blocked and is written to the learning data.

Checks Made with Any Paths

Check	Any paths default	Condition
Allowed methods	GET, OPTIONS, HEAD, POST, PUT, PATCH, DELETE	In Blocking and Monitor mode
Path length · Path depth	1–8192 · at most 256	In Blocking and Monitor mode, while Structure checks is on
Path signature scanning	On	In every mode
Query, Header, JSON, Xml, Form, Raw signature scanning	On (OWASP Check in the common rule of every section)	In every mode
Check fields structural checks	Common checks and default header rules (What are the default header rules?)	In Blocking and Monitor mode; while Structure Checks or Argument Checks is on, according to its switch

• The path of a deleted page type follows the same way: if there is a matching glob rule, it falls into that rule, otherwise into Any paths (the runtime effect of deleting).
• For the paths that fall into Any paths, learning can suggest a separate page type according to the Rule Creation Policy setting of the vService (What is the difference between the Rule Creating Mode options (Comprehensive, Data Based, Page Independent); which one should I choose?).
• How much Any paths restricts the paths that do not have their own rule also depends on the last Analysis & Learning that was applied. If the analysis is applied while Ignore Old Rules is on (Create New Rules), Any paths is set up again with a restrictive start according to the Rule Creating Mode value: in Comprehensive, the allowed method list is closed (None); in Data Based, only GET, HEAD and OPTIONS are left; in both, JSON, XML and form bodies are blocked (Block All JSON Contents and similar ones) and the query string limits are pulled down to zero. In Page Independent, the methods start with GET, HEAD and OPTIONS, and JSON, XML and form bodies are blocked. In the learning record, the requests that fall into Any paths widen these start values; in an analysis applied with Combine with Old Rules, Any paths is not restricted in this way (What is the difference between "Create New Rules" and "Combine with Old Rules" in the analysis?).

Common Misconceptions

• "An unknown path is always blocked." A request that passes the checks of Any paths passes; blocking depends on the check result and on the mode of the host group.
• "An unknown path is not inspected at all." Any paths applies the method, path limit, signature scanning and Check fields checks.
• "Tightening Any paths affects only unknown paths." Besides the paths that do not have their own rule, the Check fields sections that exact rules do not define are also completed from Any paths.

How it is done in the documentation

• WAF Rules · Runtime: Rule Matching
• Event Logs · Preview of the Selected Log
• Delete · The Runtime Effect
• Edit · Editing the Any Paths Rule

Related questions

• What is the Any Paths rule?
• Which host group does a request fall into; what if it matches none?
• What is the difference between the Rule Creating Mode options (Comprehensive, Data Based, Page Independent); which one should I choose?