What is the OWASP Protection Level; how many levels are there?

Short answer

OWASP Protection Level is the setting that determines the threshold at which the accumulated attack score turns into blocking and that is common to all the Virtual Host Groups in the vService. There are five levels and the number of the selected level is directly the threshold: Elementary 24, Normal 16, Tight 8, Very Tight 4 (default), Aggressive 2; as the number gets smaller, the protection gets tighter. The level also determines which signatures run: Low (2-point) signatures are scanned only at Aggressive and are not scanned at all at the other levels. Structural violations (24 points) and blacklist hits (100 points) reach the threshold on their own, whichever level is selected.

How Does It Work?

When the scan is finished, the total score of the request is compared with the number of the selected level; if the total is equal to or greater than this number, the request counts as an attack (blocking threshold).

Level	Threshold	Signatures that reach the threshold with a single hit	Example with accumulation	Low signatures	Odds on the card
Elementary	24	None	Three Very High hits (8 + 8 + 8)	Not scanned	very low
Normal	16	None	Two Very High hits (8 + 8)	Not scanned	very low
Tight	8	Very High	Two Medium hits (4 + 4)	Not scanned	very low
Very Tight (default)	4	Medium, High, Very High	-	Not scanned	low
Aggressive	2	All signatures, including Low	-	Scanned	high

• Structural and blacklist violations: A structural violation (24) and a blacklist hit (100) reach on their own even the threshold of the loosest level. Structural inspections run only in Monitor and Blocking modes.
• Low signatures: At the levels other than Aggressive, signatures whose Score value is Low are disabled; at these levels, they are not scanned in Learning mode either. On the OWASP Rules screen of the vService, the Score cell of these signatures appears as Low*; when it is hovered over, Low-score rule — inactive at this protection level. It only fires when the level is set to Aggressive. is written.
• Mode effect: A request that reaches the threshold is blocked only in a group in Blocking mode; in Monitor mode, it passes and is recorded; in Learning mode, since signature hits are not added to the score and no blocking decision is made, the level has no effect on blocking.

OWASP Protection Level in TR7

• Where it is seen and changed: Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → the Inspection & Blocking section, the OWASP Protection Level card. The card writes the level and the odds of blocking clean traffic in a single sentence (e.g. Very tight — Odds of blocking clean traffic: low); at Aggressive, the word high is highlighted in amber. Steps for changing it: Which protection level should I choose (Elementary, Normal, Tight, Very Tight and Aggressive)?
• List view: On the WAF-Protected vService List screen, the level of every vService appears in the OWASP protection level column.
• Scope: The level is applied across the vService; a separate level cannot be selected per Virtual Host Group (Can I set the protection level separately for each domain / host group?).
• Default: When WAF is turned on, the level comes as Very tight (4) (What is the default protection level?).

Common Misconceptions

• "As the level goes up, the number gets bigger." The opposite; the threshold of the tight levels is small. The tightest level is Aggressive (2), and the loosest level is Elementary (24).
• "At Elementary, WAF blocks nothing." Structural violations (24) and blacklist hits (100) reach the threshold on their own at Elementary as well; signature hits can also reach 24 by accumulating.
• "The level changes only the threshold." At the levels other than Aggressive, Low signatures are not scanned at all; switching to Aggressive also brings these signatures into play.
• "The level blocks in Learning mode as well." In Learning mode, since signature hits are not added to the score and no blocking decision is made, the level does not affect blocking.

How it is done in the documentation

• OWASP Protection Level · What Is OWASP Protection Level?
• WAF · The Blocking Threshold
• Signature & Rule Library · Score Values and the Protection Level
• OWASP Rules · The Effect of the Protection Level on the View

Related questions

• What is the default protection level?
• Which protection level should I choose (Elementary, Normal, Tight, Very Tight and Aggressive)?
• What is the attack score and how is it calculated?
• How does the protection level affect what the OWASP Rules screen shows?