Can I set the protection level separately for each domain / host group?

Short answer

No. OWASP Protection Level is a single setting across the vService and is common to all the Virtual Host Groups on that vService; the value set per Virtual Host Group is WAF Mode. If a different threshold or completely separate WAF settings are needed for a domain name, that domain name is published on a separate HTTP vService; a new IP address is not needed for this: with Virtual Hosting, a separate vService that is separated according to the Host header (SNI in HTTPS) can be opened on the same IP:Port. WAF is turned on separately on this vService, and all the WAF settings, including OWASP Protection Level, are selected independently of the other vService. Within the same vService, the strictness for a domain name is differentiated with the WAF mode value of its group and with the OWASP Check and OWASP Exclusions fields in the Page Types rules of the group; the signature state and score on the OWASP Rules screen, on the other hand, are applied to all the groups together. If Sync with Default WAF Rules is checked, the synchronization is applied to the Any Paths rule of all the groups at once.

How Does It Work?

Setting	Scope	Where
OWASP Protection Level (the threshold and the scanning of the Low signatures)	Across the vService	WAF Management → Inspection & Blocking
WAF Mode (Learning, Monitor, Blocking)	Virtual Host Group	WAF Management → the mode card of the group
Page Types rules, field-based OWASP Check and OWASP Exclusions	Virtual Host Group	WAF Management → the Page Types row on the mode card of the group
Signature state and score (State, Score)	Across the vService	OWASP Rules
Structure Checks, Argument Checks, Max. OWASP Exclusions	Across the vService	Inspection & Blocking

The request falls into a Virtual Host Group according to the Host header; its total score is compared with the same threshold, whichever group it is in. Only the mode and the rule list of the groups are separate from each other.

Separating by Domain Name in TR7

Need	Path
There should be no blocking at all on a domain name, and the attacks should be recorded	A separate Virtual Host Group is created for the domain name and the group is kept in Monitor mode (Can I use different modes for different domains on the same vService?)
A specific signature produces false positives on a domain name	The signature is added to the OWASP Exclusions list in the related Page type rule of that group; the other groups are not affected
Signature scanning is not wanted on a field of a domain name	The OWASP Check switch of the field is turned off in the related Page type rule of that group
A different threshold or completely separate WAF settings are needed on a domain name	The domain name is published on a separate HTTP vService; with Virtual Hosting, this vService shares the same IP:Port with the existing vService, and the requests are separated according to the Host header (SNI in HTTPS); the domain name must be defined in the Virtual Hosting list of all the vServices that share the IP:Port. WAF is turned on separately on the new vService; OWASP Protection Level, Page types and all the other WAF settings are independent of the existing one (What is Virtual Hosting, and how does it work?)

Common Misconceptions

• "Each Virtual Host Group has its own protection level." OWASP Protection Level is applied across the vService; only the WAF mode is selected per group.
• "Sync with Default WAF Rules affects only the open group." Sync with Default WAF Rules sets up the Any paths rule of all the groups again.
• "Disabling a signature in OWASP Rules affects only one group." A change on the OWASP Rules screen is applied to all the groups of the vService; the differentiation per group is made with OWASP exclusions.
• "A new IP address is needed for separate WAF settings." Each vService that shares the same IP:Port with Virtual Hosting carries its own WAF settings (Can I publish more than one website behind a single public IP?).

How it is done in the documentation

• OWASP Protection Level · What Is OWASP Protection Level?
• Virtual Host Groups · What Is Virtual Host Groups?
• WAF Mode · What Is WAF Mode?
• HTTP (L7) vService · Virtual Hosting
• OWASP Rules · The Rule Layers and the Place of This Screen

Related questions

• Can I use different modes for different domains on the same vService?
• Which protection level should I choose (Elementary, Normal, Tight, Very Tight and Aggressive)?
• What is the OWASP Protection Level; how many levels are there?
• Is it better to disable a signature entirely or to add an OWASP exclusion?