What does turning OWASP scanning on or off at the Page Type level mean?

Short answer

The OWASP box in the rule form manages the signature scanning of the path section only. While it is checked, the path of the request is scanned with the signature set valid on the vService (except the signatures selected in the OWASP Exclusions field); while it is unchecked, the path is not scanned in Blocking and Monitor mode. The scanning of the Query, Header, JSON, Xml, Form and Raw sections is independent of this box; each of them depends on its own OWASP Check setting in Check Fields. In a new rule, the box is unchecked by default, and in Any Paths it is checked. Since the path setting is not inherited, leaving the box unchecked in an exact or glob rule also excludes that path from the path scanning of Any paths. If the OWASP exclusions list exceeds the Max. OWASP Exclusions limit, scanning is turned off at that point. In Learning mode, the path is scanned in every case. Structural checks (Allowed Methods, Path Length, Path Depth) are not affected by this box.

How Does It Work?

Section	Setting that manages the scanning
Path	The OWASP box and the OWASP Exclusions list in the rule form
Query, Header, JSON, Xml, Form, Raw	The OWASP Check setting in the common rule and in the argument rules of the relevant section in Check fields (Can I turn off OWASP scanning for a specific parameter?)
Uploaded files	The OWASP Check in Upload setting in the Form section (together with the OWASP check setting of the Raw section)
Allowed methods, Path length, Path depth	Independent of the OWASP box

• The signature set used in the scanning is the set that appears on the OWASP Rules screen of the vService; the status and scores of the signatures also come from there. A hit of a signature is added to the score, and the blocking decision is made according to the OWASP Protection Level threshold.
• The OWASP Exclusions field appears only while the box is checked; exclusions are selected from the signatures of the vService with multiple selection.
• On the Path tab of the detail panel, the OWASP Check row appears with a check mark if the box is checked, and with the number of exclusions if there are exclusions (the displayed fields).
• The setting is changed via Page types → rule → Edit → OWASP and is saved with the Edit button of the form. In WEB-CLI, the waf fw-rules update poolId <vService> hostGroupId <group> id <rule> --argOwasp true command is used (OWASP inspection).
• If all the OWASP settings are turned off in all the rules (including Any paths), the vService works only with the positive model, except in Learning mode (What is TR7's hybrid security model; how do the two models work together?).

Common Misconceptions

• "If the box is unchecked, the request does not go into signature scanning at all." Only the path is not scanned; the other sections are scanned according to their own OWASP check settings.
• "In a new rule, the box comes checked." The default is unchecked; if path scanning is wanted, it is checked.
• "If scanning is on in Any paths, every path is scanned." The path setting is not inherited; on a path that has its own rule, the box of that rule is valid.
• "The only way to turn off a signature is an exclusion." A signature can also be turned off across the vService from the OWASP Rules screen (Is it better to disable a signature entirely or to add an OWASP exclusion?).

How it is done in the documentation

• Add · OWASP
• Path · The Displayed Fields
• OWASP Protection Level · Max. OWASP Exclusions
• WEB-CLI waf fw-rules · The OWASP Inspection

Related questions

• Can I turn off OWASP scanning for a specific parameter?
• Is it better to disable a signature entirely or to add an OWASP exclusion?
• What is TR7's hybrid security model; how do the two models work together?