What does the "Max. Owasp Exclusions" setting do; what happens if the limit is exceeded?

Short answer

Max. OWASP Exclusions is the maximum number of signature exclusions that can be effective in the OWASP Exclusions list of an inspection point; an inspection point is the common rule or the rule of a single parameter in the Path, Query, Header, JSON, XML, Form or Raw field of a Page Type rule. The default value is 25, and an integer of at least 1 is entered; the value is applied to all the rules across the vService. If the list exceeds this number, the exclusions are not applied one by one at that point, but the signature scan is turned off entirely; the saved list is not deleted. If a new exclusion needs to be added to a list that has reached the limit while the Analysis & Learning result is being applied, the OWASP Check switch of that point is turned off and the list is emptied. The setting is not a hit or log limit. The value is entered from the edit window of the OWASP Protection Level card and saved with Edit.

How Does It Work?

Situation	Result
The list has as many exclusions as the limit or fewer	The exclusions are applied; the signatures that are not in the list are scanned
The list exceeds the limit (26 or more exclusions with the default)	The signature scan is turned off at that inspection point; the list stays saved
While Analysis & Learning is being applied, the list has reached the limit and a new exclusion is needed	The OWASP Check switch of the point is turned off and the list is emptied
Don't Learn OWASP Exclusions is checked in the analysis (checked by default)	The analysis adds no exclusions at all
While Page types are being merged with Merge, the union of the two lists exceeds the limit	In the merged rule, the OWASP Check switch of that point is turned off and the list is emptied; if OWASP Check is off on one of the sides, it also stays off in the merged rule

• The purpose of the limit is to prevent the exclusion lists from growing uncontrollably and to single out the inspection points where a large number of signatures are silenced.
• The value is applied to all the rules in all the Virtual Host Groups of the vService; there is no separate limit per group or per rule.
• At the point where the signature scan is turned off, the structural inspections continue; the only thing not produced is the signature hits.

How Is It Configured?

From the Interface

1

Adım 1 Open the WAF Management tab

The Left Monitor Panel is opened; WAF-Protected vServices is selected from the category tabs, the vService is clicked and the WAF Management tab is opened.

2

Adım 2 Open the edit window

The pencil icon at the top right of the OWASP Protection Level card in the Inspection & Blocking section is clicked; the window titled OWASP Protection Level opens.

3

Adım 3 Enter the limit

An integer of at least 1 is entered in the Max. OWASP Exclusions field. The Sync with Default WAF Rules box in the same window is left unchecked; if it is checked, the Any paths rules return to their default.

4

Adım 4 Save

Edit is clicked; the value is applied without a separate deployment step. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually.

With WEB-CLI

In WEB-CLI, the value is written with the --maxOwaspExclusions field (basic inspections). --syncWithDefaultFwRules is not a stored setting but a write trigger: the Any paths rules are set up again with their default definition only when true is written; if it is not written in the command, the rule set is not touched. The false in the command states this explicitly:

waf options update poolId <vService> --maxOwaspExclusions 30 --syncWithDefaultFwRules false

For more than one vService, the bulk command is used; the command opens the selection list and asks for confirmation:

waf options update-many target selected --maxOwaspExclusions 30

Verification

• In the waf options show poolId <vService> command, maxOwaspExclusions carries the new value.
• The exclusions of an inspection point are seen in the OWASP Exclusions field of the related tab in the Check Fields panel of the Page type; at the points where exclusions are defined, the number of exclusions is written next to the ✓ mark in the OWASP Check row of the detail panel.

Common Misconceptions

• "This setting is a hit or log limit." Max. OWASP Exclusions limits only the size of the exclusion list; it does not affect how many hits are counted in a request or how many records are written.
• "In a list that exceeds the limit, only the first 25 exclusions are applied." When the list exceeds the limit, the signature scan is turned off entirely at that inspection point.
• "Keeping the value very low is safer." If the limit is low, the signature scan may be turned off at many points where exclusions are added, or the OWASP Check switches may be turned off while the analysis is being applied.
• "Keeping the value very high is harmless." Dozens of signatures can be excluded on a parameter, and this point goes unnoticed.
• "If --syncWithDefaultFwRules is not written in WEB-CLI, the Any paths rules return to their default." They do not; the field is not a stored setting but a write trigger, and the Any paths rules are set up again only when --syncWithDefaultFwRules true is written.

How it is done in the documentation

• OWASP Protection Level · Max. OWASP Exclusions
• Query · OWASP Exclusions
• Analysis & Learning · Advanced Settings
• WEB-CLI waf options · The Basic Inspections

Related questions

• Is it better to disable a signature entirely or to add an OWASP exclusion?
• When should the "Don't Learn OWASP Exclusions" option be checked?
• How does tightening the protection level affect false positives?
• Which protection level should I choose (Elementary, Normal, Tight, Very Tight and Aggressive)?