How do I measure the time the WAF adds to a request; for which requests is it visible?

Short answer

TR7 measures the time the WAF spends scanning a request in milliseconds and writes it to the Event Logs record as WAF Time. For a single request, the record is clicked in Event Logs and WAF Time on the Request & Location tab is read; for the distribution over a period, the WAF Time breakdown in the Traffic view of WAF Report (seven ranges from below 0.1 ms to above 1 second) is used; in the attack information sent to SIEM, the same value is in the wafTime field (TR7 WAF log basic fields). The value is the duration of the scan; waiting for the body to arrive from the network is not included, and at busy moments it can read higher than it actually is. The time exists only in requests written to Event Logs: requests that reach the blocking threshold in a group in Monitor or Blocking mode (including those that come with the Teacher identity and are not blocked) or that trigger a signature in Monitor state. The WAF time of clean requests, of the traffic in Learning mode and of requests that come with the Conditional Learning identity is not on any screen; the general load is monitored with the CPU, Memory Usage and HTTP Request/s cards in Live Stats.

Problem: The Latency the WAF Brings Is Unknown

The application team asks how much time the WAF adds to requests. It must be known from which screens the time is read and in which requests it cannot be measured.

Solution: Four Methods

The first three methods read the measured time of the requests written to Event Logs; the fourth monitors the load of all the traffic indirectly.

Your situation	Suitable method
I want to see the WAF time of a single request	Method 1: Event Logs
I want to see the time distribution of a period	Method 2: WAF Report
I want to calculate the percentiles in my own system	Method 3: SIEM
I want to monitor the general load, including clean traffic	Method 4: Live Stats

Method 1: Event Logs Recommended

• How it works The WAF time of that request is read in the details of the record.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → Event Logs tab → record → Request & Location
• Requirement WAF permission · host group in Monitor or Blocking mode
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Event Logs tab

The Left Monitor Panel → WAF-Protected vServices → vService → Event Logs tab is opened.

2

Adım 2 Find the record

If needed, the record is fetched in the server filter with Date Range or Request Unique ID (How do I find a specific request by its Request Unique ID?).

3

Adım 3 Read the time

The record is clicked; WAF Time is read on the Request & Location tab of the preview (Can I see how long a request spent in the WAF (WAF Time)?). To see the time of a clean request, a test request that triggers a signature in Monitor state can be sent; even if this request stays below the blocking threshold, it is written to Event Logs (How do I try a new signature in production without risk (Monitor state)?).

Verification

1PreviewTR7 side

The WAF Time row on the Request & Location tab is examined.

ExpectedA value in milliseconds

Method 2: WAF Report

• How it works The WAF time of the requests written to Event Logs in the selected period is shown as a distribution in seven ranges.
• Where it is opened vService → Dashboard → For Detailed Analysis → WAF Report · or WAF Management → Learning & Reporting → Periodic Reporting card → Generate Report
• Requirement WAF permission
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the WAF Report tab

The For Detailed Analysis → WAF Report shortcut on the Dashboard tab of the vService or the Generate Report link on the Periodic Reporting card on the WAF Management tab is clicked; the WAF Report tab opens (how to access).

2

Adım 2 Open the report form

The Generate Report button on the tab is clicked; the report form opens (Generate Report screen).

3

Adım 3 Select the format and the period

Report Type = html is left as it is and the period is selected in the Date field.

4

Adım 4 Generate the report

Accept is clicked; the report opens in the tab.

5

Adım 5 Read the distribution

The Traffic view is opened; the WAF Time breakdown shows the <0.1ms, 0.1ms-0.5ms, 0.5ms-1ms, 1-10ms, 10-100ms, 100-1000ms and >1s ranges (HTML report). The body size breakdown in the same view is compared side by side.

Verification

1ReportTR7 side

The WAF Time breakdown in the Traffic view is examined.

ExpectedThe number of requests per range

Method 3: SIEM

• How it works The wafTime value in the attack information is turned into statistics in the external system.
• Where it is opened The log profile assigned to the vService (CEF, TR7 JSON or TR7 WAF Log format)
• Requirement A log profile that carries the WAF information being assigned to the vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Transfer the records

A log profile that carries the WAF information is assigned to the vService and the records are sent to SIEM; the setup steps are described on the How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)? page.

2

Adım 2 Calculate the percentiles

In SIEM, the percentiles are calculated from the wafTime field (TR7 WAF log basic fields). The wafTime value 2000 in requests blocked because of a timeout is a fixed marker, not a measurement; it is excluded from the calculation.

Verification

1SIEMSIEM side

The WAF information of the incoming record is examined.

ExpectedThe wafTime field

Method 4: Live Stats

• How it works The total load of the vService, including clean traffic, is monitored; the share of the WAF is not shown separately.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → Live Stats tab
• Requirement WAF permission
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Monitor the cards

On the Live Stats tab, the CPU, Memory Usage and HTTP Request/s cards are read together; in a cluster, every device appears in a separate column (What is monitored for the WAF on the Live Stats screen?). The approximate effect is seen by comparing similar periods or similar vServices.

Verification

1CardTR7 side

The CPU card is examined.

ExpectedThe instantaneous CPU usage of the vService

Common Mistakes

• Looking for the time of clean requests. The WAF time of requests that are not written to Event Logs is not on any screen.
• Looking for the WAF share in the Backend Service response time panels. These panels measure the response time of the Backend Service; they do not include the WAF time.
• Treating the value at busy moments as the exact time of the request. Under heavy load, the value can read higher than it actually is (What exactly does the WAF Time value measure?).
• Expecting the body wait time in WAF Time. While the body is awaited from the network, no scanning is done; this time is not included in the value.

How it is done in the documentation

• Event Logs · Request & Location Tab
• WAF Report · The HTML Report
• Live Stats · Frontend
• TR7 WAF Log · Basic Fields

Related questions

• Can I see how long a request spent in the WAF (WAF Time)?
• What exactly does the WAF Time value measure?
• What is monitored for the WAF on the Live Stats screen?