What is the attack score and how is it calculated?

Short answer

The attack score is the total of the scores of all the violations detected in a request, and the blocking decision is made only according to this total. The Score value of every signature is Low (2), Medium (4), High (6) or Very High (8); three signature rules in the built-in library have 9 points and appear as Very High. Structural violations add 24 and a blacklist hit adds 100 points. If more than one signature, or the same signature in different parameters, is triggered in the same request, the scores are summed. Signatures that have been put into the Monitor state on the OWASP Rules screen are recorded with their real scores but do not take part in the total; in Learning mode, signature hits are not added to the score and no blocking decision is made. The total score can be filtered in Event Logs with the WAF score field of Log Filter.

How Does It Work?

Violation	Score	Severity in Event Logs
Signature hit: Score Low · Medium · High · Very High	2 · 4 · 6 · 8	Low · Medium · High · Very high
Three built-in signature rules: Spring4Shell Exploitation, ProxyShell ProxyLogon Exploit, Cloud Metadata SSRF	9	Very high
Structural violation: a path, parameter, header or body that does not comply with the Check Fields inspections	24	Structural
Blacklist hit: a source address within the scope of Blacklist Protection	100	Blacklist

1. Every hit found during the scan is added as a separate record. The same signature is counted once in a single scanned value; if it is triggered in different parameters or in different request sections (path, query, header, JSON, XML, form, raw body), each one adds a separate score.
2. The score of every record is added to the total. There are two exceptions: the record of a signature in the Monitor state carries its real score but does not take part in the total; in a request that is in Learning mode or recognized with Conditional Learning, signature hits are not added to the total; in a group in Learning mode, the 100 points of a blacklist hit are added, but no blocking decision is made.
3. When the scan is finished, the total is compared with the OWASP Protection Level value of the vService; if the total is equal to or greater than this value, the request counts as an attack (How does TR7 WAF decide whether to block a request?).

Example: At the default Very Tight level (threshold 4) and in a group in Blocking mode, if a signature with a High (6) score is triggered in one parameter and a signature with a Medium (4) score in another parameter, the total becomes 10 and the request counts as an attack. If only a High signature in the Monitor state had been triggered in the same request, the total would have stayed 0; the request would have passed and appeared in Event Logs as Not blocked — Below the blocking threshold.

Structural violations are produced only in Monitor and Blocking modes; most of the structural inspections depend on the Structure Checks or Argument Checks master switch and do not run while the switch is off. A blacklist hit is written only while Blacklist protection is on (on by default).

Where Is the Score Set and Seen in TR7?

• Changing the score: The Score value of a signature is changed device-wide on the Signature & Rule Library screen, and for a single vService on the OWASP Rules screen of that vService; the values that can be selected are only Low, Medium, High and Very High (Score). The score of a signature is read first from the built-in value, then from the global layer and last from the vService layer; the more specific layer wins (rule layers). The default score of a manually added signature is Medium (Can I change a signature's score (Low / Medium / High / Very High)?).
• Structural and blacklist scores: 24 and 100 are fixed; they are not changed from the interface.
• Seeing: Left Monitor Panel → WAF-Protected vServices → vService → Event Logs is opened. The Attacks tab in the preview of the record shows every hit on a separate row, with the severity in the Attack name row (e.g. (Very high)). The WAF score field in the WAF group of Log Filter filters by the total score.
• Severity column: Severity in Event Logs shows not the total score of the record but the level of the highest single hit in the record.
• Condition for the record to be created: Only requests whose total reaches the threshold and requests in which a signature in the Monitor state was triggered are written to Event Logs; active signature hits that stay below the threshold do not produce a record (log production).

Common Misconceptions

• "Hits that stay below the threshold are logged as well." A request whose total stays below the threshold is not written to Event Logs; a record is created only if a signature in the Monitor state has been triggered.
• "Severity is the total score." Severity shows the highest single hit; the total score is seen with the WAF score field in Log filter.
• "An intermediate score can be given to a custom signature." Score can only be Low, Medium, High or Very High.
• "A signature in the Monitor state blocks the request on its own." A signature in the Monitor state does not take part in the total; if the active hits in the same request reach the threshold, the request is still blocked.

How it is done in the documentation

• WAF · Violation Scores
• Signature & Rule Library · Score Values and the Protection Level
• Signature & Rule Library · The Rule Layers
• Event Logs · The Severity Values

Related questions

• How does TR7 WAF decide whether to block a request?
• In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?
• Can I change a signature's score (Low / Medium / High / Very High)?
• If a request contains several attacks, does the WAF stop at the first match or evaluate all of them?