Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How does TR7 WAF decide whether to block a request?
Short answer
TR7 WAF does not decide by looking at a single rule: it scans the request from beginning to end, adds every violation it finds to the attack score of the request and makes the decision when the scan is finished. Signature hits add 2 to 8 points according to the risk level (9 in three built-in signature rules), structural violations add 24 and a blacklist hit adds 100 points; the total is compared with the OWASP Protection Level value of the vService (24, 16, 8, 4 or 2). If the total reaches or exceeds this threshold and the Virtual Host Group the request falls into is in Blocking mode, the request is blocked; the Blocking Page content is returned to the client with the Blocking Status Code (default 418). In Monitor mode, the request passes and is written to Event Logs; in Learning mode, signature hits are not added to the score and no blocking decision is made; a request recognized as Teacher is not blocked, whatever its score. Requests within the scope of Do not WAF static contents or Whitelist Condition are not inspected at all; in Blocking mode, if the scan cannot be completed within the 2-second time limit, the request is also blocked (if Fail-open is on, it is passed without being scanned).
How Does It Work?
A request that comes to an HTTP vService on which WAF is on is processed in the following order (how it works):
- Exemption: Static content requests within the scope of Do not WAF static contents (on by default) and requests that match the Whitelist Condition do not enter the WAF inspection at all; they are not scored and are not blocked.
- Blacklist: If Blacklist Protection is on (on by default), when the source address is in the selected blacklist categories or in the Frontend Blacklist, a 100-point violation is written to the request; for the addresses in Frontend Blacklist Exclusions, this violation is not written. The request is not cut off at this point; the scan continues.
- Group and mode: The request is mapped to a Virtual Host Group according to the
Hostheader, and the WAF Mode value of that group is applied. A request that matches the Conditional Learning condition is processed as in Learning mode, whatever mode the group is in. - Inspection: The path of the request is matched with the rules in the Page Types list of the group; the path, query, header and body sections go through the signature scan and the Check Fields inspections of the rule. Every violation is added to the score. Structural inspections run only in Monitor and Blocking modes.
- Score: The scores of all the violations are summed. Signatures that have been put into the Monitor state on the OWASP Rules screen are recorded but do not take part in the total; in Learning mode, signature hits are not added to the score and no blocking decision is made.
- Decision: When the scan is finished, the total is compared with the OWASP Protection Level value (blocking threshold); if the total is equal to or greater than the threshold, the request counts as an attack and the result is applied according to the mode.
| Situation | Request | Record |
|---|---|---|
| Total ≥ threshold, group in Blocking mode | Blocked; the Blocking Page content is returned with the Blocking Status Code (default 418); if Conditional Blocking Pages are defined, the page whose condition matches first is used | Event Logs: Attack blocked |
| Total ≥ threshold, group in Monitor mode | Passes | Event Logs: Not blocked — Monitor mode |
| Total < threshold, a signature in the Monitor state was triggered | Passes | Event Logs: Not blocked — Below the blocking threshold (Not blocked — Monitor mode if the group is in Monitor mode) |
| Total < threshold, only active signatures were triggered | Passes | No Event Logs record |
| A request recognized as Teacher, group in Monitor or Blocking mode; total ≥ threshold or a signature in the Monitor state was triggered | Passes | Event Logs: Not blocked — Teacher IP matched (Teacher cookie or Teacher header, according to the identity) |
| Group in Learning mode, or the request was recognized with Conditional learning | Passes | No Event Logs record; the request is written to the learning log |
| The scan could not be completed within the 2-second time limit | Blocked if the group is in Blocking mode (passes if Fail-open is on); passes in Learning and Monitor mode and in a request that comes with a Teacher or Conditional Learning identity (if the scan was cut off while the rules were being loaded and before the host group was determined, and the vService has a group in Blocking mode, it is blocked in Learning and Monitor mode as well; WAF Mode · Blocking Mode) | No Event Logs record; while the vService is in Debug Mode, a blocked request appears in Debug Mode Logs as Attack blocked — scan timed out |
Details of the scores: What is the attack score and how is it calculated? Levels and thresholds: What is the OWASP Protection Level; how many levels are there?
Settings That Determine the Decision in TR7
| Setting | Scope | Where |
|---|---|---|
| OWASP Protection Level (threshold) | vService-wide | WAF Management → Inspection & Blocking |
| WAF Mode (Learning, Monitor, Blocking) | Virtual Host Group | WAF Management → mode card |
| Signature score and state (Score, State) | vService-wide or the whole device | OWASP Rules · Signature & Rule Library |
| Structure Checks and Argument Checks | vService-wide | Inspection & Blocking → Checks |
| Exemption and blacklist | vService-wide | Inspection & Blocking → Whitelist & Blacklist |
| Blocking response | vService-wide | Inspection & Blocking → Blocking Page |
The distribution of the decisions is followed on the WAF Inspection Distribution panel of the vService Dashboard with the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning series; individual decisions are seen in the Action column in Event Logs.
Common Misconceptions
- "WAF cuts off the request at the first matching rule." The request is scanned in its entirety; the decision is made when the scan is finished (If a request contains several attacks, does the WAF stop at the first match or evaluate all of them?).
- "When WAF is turned on, attacks are blocked immediately." When the protection is turned on, the default Virtual Host Group starts in Learning mode; blocking happens only in Blocking mode (Does traffic start being blocked as soon as I enable the WAF?).
- "An address on the blacklist is blocked immediately." A blacklist hit is added as 100 points, and the decision is made at the end of the scan according to the mode; it is not blocked in a group in Learning mode or in a Teacher request.
- "In Monitor mode, the score is not calculated." In Monitor mode, the inspection and the score are the same as in Blocking; only the blocking is not applied.
How it is done in the documentation
Related questions
- What is the attack score and how is it calculated?
- What is the OWASP Protection Level; how many levels are there?
- In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?
- I am blocking legitimate users by mistake; how do I find out?
