In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?

Short answer

A request is let through in six cases even though an attack is detected. If the Virtual Host Group is in Monitor mode, the score is calculated in full as in Blocking, a request that reaches the threshold passes and is recorded in Event Logs as Not blocked — Monitor mode. If the signature is in the Monitor state on the OWASP Rules screen, the hit is recorded with its real score but does not take part in the total; if the total stays below the threshold, the request passes and appears as Not blocked — Below the blocking threshold. A request recognized as Teacher is not blocked by the WAF decision even if its score reaches the threshold, and it is recorded as Not blocked — Teacher IP matched (Teacher cookie or Teacher header, depending on the identity). In a group in Learning mode and in a request recognized with Conditional Learning, the signatures are scanned but their hits are not added to the score; the hits are written not to Event Logs but to the learning log. If the total of the active signatures stays below the threshold, the request also passes and no record is produced. A signature in the Monitor state does not prevent the blocking by the active signatures in the same request. A request whose scan cannot be completed within the 2-second time limit is also let through when it comes with the Teacher or Conditional Learning identity; in Learning and Monitor modes, it is also let through, except for one exception that can occur while the rules are being loaded.

How Does It Work?

Situation	Score	Event Logs record	Dashboard series	Is it blocked
Virtual Host Group in Monitor mode	Calculated in full (including the structural inspections)	If the total reaches the threshold or a signature in the Monitor state is triggered: Not blocked — Monitor mode	Monitor if the total reached the threshold	No
Signature in the Monitor state, group in Blocking mode	The hit is recorded with its real score, does not take part in the total	Always; if the total is below the threshold, Not blocked — Below the blocking threshold	Clean if the total is below the threshold	No (unless the active hits reach the threshold)
Request recognized as Teacher, group in Monitor or Blocking mode	Calculated in full	If the total reaches the threshold or a signature in the Monitor state is triggered: Not blocked — Teacher IP matched (Teacher cookie or Teacher header, depending on the identity)	Teacher if the total reached the threshold	No
Group in Learning mode	Not accumulated; the structural inspections do not run	None; the request is written to the learning log	Learning	No
Request recognized with Conditional Learning	Not accumulated, as in Learning mode	None; the request is written to the learning log	Learning	No
Only active signatures, total below the threshold	Calculated	None	Clean	No

In the Teacher record, if the source of the Teacher definition is known, the sentence is written in the form Not blocked — <source> matched. In Learning mode, the signature scan is done by ignoring the field-based OWASP Check switches and the OWASP Exclusions lists; the signatures in the Disabled state and the Low signatures that are disabled because of the level are not scanned in this mode either.

Scan time limit: If the WAF scan cannot be completed within the 2-second time limit, the request is let through in Learning and Monitor modes and when it comes with the Teacher or Conditional Learning identity; it is blocked only in a group in Blocking mode (the only exception is the scan being cut off while the WAF rules are being loaded and before the host group is determined: if the vService has a group in Blocking mode, a request that comes to a group in Learning or Monitor mode is also blocked; Teacher and Conditional Learning requests are outside this exception (WAF Mode · Blocking Mode); if Fail-open in the Request Body Limits window is on, the request is let through without being scanned there too). This blocked request is not written to Event Logs; while the vService is in Debug Mode, it appears in Debug Mode Logs as Attack blocked — scan timed out (What happens to a request if the scan exceeds a certain time (2-second scan limit)?).

Where Is It Monitored in TR7?

• Event Logs: Left Monitor Panel → WAF-Protected vServices → vService → Event Logs. The Action column shows the decision with three icons: blocking, monitoring (Monitor mode and a signature in the Monitor state) and Teacher; the sentence in the preview of the record writes one of the values above. The Monitor Only field in the Log Filter filters the records that were written only because of a signature in the Monitor state, without the total reaching the threshold.
• Dashboard: The WAF Inspection Distribution panel on the Dashboard of the vService shows the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning series.
• Signature state: Whether a signature is in the Monitor state is seen in the State column on the OWASP Rules screen of the vService (What does a signature's state (Enabled / Monitor / Disabled) mean?).

Record production by mode: In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?

Common Misconceptions

• "Monitor mode does not calculate a score." In Monitor mode, the inspection, the score and the threshold comparison are the same as in Blocking; only the blocking is not applied.
• "A signature in the Monitor state lets the request through under all conditions." The signature does not take part in the total, but if the active hits in the same request reach the threshold, the request is blocked.
• "In Learning mode, the attacks are seen in Event Logs." In Learning mode, the hits are written only to the learning log; Event Logs stays empty.
• "An address on the blacklist is also blocked in Learning mode." A blacklist hit is also added to the score as 100 in Learning mode, but since no blocking decision is made in this mode, the request is not blocked (WAF Mode · Blocking Mode).

How it is done in the documentation

• WAF · The Three Situations That Do Not Enter the Score
• Event Logs · The Action Values
• Event Logs · Under Which Condition Is the Log Produced?
• WAF Mode · Runtime Behavior of the Modes

Related questions

• How does TR7 WAF decide whether to block a request?
• In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?
• How do I try a new signature in production without risk (Monitor state)?
• I am blocking legitimate users by mistake; how do I find out?