Does latency grow as the number of rules grows?

Short answer

It does not grow proportionally in terms of the number of signatures (the distinction between the signature and the pattern). The signatures are not tried one by one in sequence: the patterns of each layer (the built-in signature library, the device-wide custom rules, the vService-specific custom rules) are in a single precompiled database, and every value of the request is scanned against the loaded databases; query and URL-encoded form values, if they contain encoding, are scanned once more in their decoded form. For this reason, adding signatures to the library does not change the number of values scanned. Disabled signatures and signatures left out of scope in a field do not produce hits or scores; at the OWASP Protection Level levels other than Aggressive, the signatures with a score of 2 are off. What mainly grows the time is the amount of data scanned: the number of parameters, the body size, the JSON and XML depth. The effect of the number of page types is limited: exact path page types are found directly; for glob page types, the match result of a path is calculated when it is first seen and remembered. When the state, score or scope of a signature changes, no recompilation is required; pattern changes are compiled in the background (recompiling of the signature database). The WAF does not stop at the first hit in a request; it scans all the values; as the number of hits grows, the recording cost grows.

What Affects the Time?

Variable	Effect on the time
Number of built-in or custom signatures	Not proportional; a single compiled database per layer (performance)
Number of loaded databases	At most three: the built-in library, the device-wide custom rules and the vService-specific custom rules; the database of a layer that has no custom rules is not loaded
Disabled signatures or signatures outside the scope	Do not produce hits or scores
Number and size of the values scanned	Affect it directly
Exact path page types	Found directly
Glob page types	The match result of the path is calculated when it is first seen and remembered (at most 10,000 different paths per host group; the later ones are calculated on every request)
Number of hits	Extracting the matched value for the record and writing the record

• On the first requests after the configuration is reloaded, the glob page type and host group patterns are prepared; if many glob patterns are defined, these first requests can take a little longer.
• Signature and pattern counts: How many signatures / rules does TR7 WAF have? · What is the difference between a signature and a pattern; why are "Unique Signature Patterns" and "Total Active Signatures" different numbers?
• Operations that do and do not require compilation: OWASP Rules · The Counterpart of the Operations on This Screen
• Evaluation of all the hits: If a request contains several attacks, does the WAF stop at the first match or evaluate all of them?
• Measurement: How do I measure the time the WAF adds to a request; for which requests is it visible?

Common Misconceptions

• "Adding signatures increases the latency proportionally." The patterns are scanned together in the compiled database.
• "Many page types are tried one by one on every request." An exact path is found directly; glob results are remembered per path.
• "Making a signature Disabled requires recompilation." State, score and scope changes do not require compilation.

How it is done in the documentation

• WAF · Performance
• Signature & Rule Library · The Distinction Between the Signature and the Pattern
• Signature & Rule Library · Recompiling of the Signature Database
• OWASP Rules · The Counterpart of the Operations on This Screen

Related questions

• How many signatures / rules does TR7 WAF have?
• What is the difference between a signature and a pattern; why are "Unique Signature Patterns" and "Total Active Signatures" different numbers?
• If a request contains several attacks, does the WAF stop at the first match or evaluate all of them?