What is the default protection level?

Short answer

When WAF is turned on in a vService, OWASP Protection Level comes as Very tight (threshold 4) by default. At this level, a single signature hit with a Medium, High or Very High score is enough to reach the threshold; signatures with a Low score, on the other hand, are not scanned at all. For this level, the card shows the odds of blocking clean traffic as low. Since the default Virtual Host Group starts in Learning mode when WAF is turned on, the default level blocks no request until the group is put into Blocking mode.

How Does It Work?

At the Very Tight level, a request counts as an attack when its total attack score reaches 4:

Hit	Score	Result at Very tight
A single Medium signature	4	Reaches the threshold
A single High or Very High signature	6 · 8	Reaches the threshold
Low signature	2	Not scanned; produces no score
Structural violation	24	Reaches the threshold
Blacklist hit	100	Reaches the threshold

The other defaults that are created together with the level when WAF is turned on (Learning mode, Blocking Status Code 418, Max. OWASP Exclusions 25, etc.): Which default settings are created when WAF is enabled?

Where Is It Seen in TR7?

• WAF Management card: In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Inspection & Blocking section, the OWASP Protection Level card shows the sentence Very tight — Odds of blocking clean traffic: low.
• List: The OWASP protection level column on the WAF-Protected vService List screen.
• WEB-CLI: The waf options show poolId <vService> command lists the WAF settings of the vService; at the default level, the value of the owaspProtectionLevel field is 4 (waf options).

Steps for changing the level: Which protection level should I choose (Elementary, Normal, Tight, Very Tight and Aggressive)?

Common Misconceptions

• "The default level is loose." Very Tight is the tightest level after Aggressive; a single Medium hit is enough to reach the threshold.
• "When WAF is turned on, Very tight starts blocking immediately." The default Virtual Host Group starts in Learning mode; blocking happens in Blocking mode (Does traffic start being blocked as soon as I enable the WAF?).
• "The default level cannot be changed." The level is set to the desired value from the card; to return to Very tight, Very tight is selected again from the list.

How it is done in the documentation

• OWASP Protection Level · OWASP Protection Level
• How to Enable WAF · What Is Created After It Is Enabled?
• WAF · Typical Deployment Flow

Related questions

• What is the OWASP Protection Level; how many levels are there?
• Which protection level should I choose (Elementary, Normal, Tight, Very Tight and Aggressive)?
• Which default settings are created when WAF is enabled?