If a request contains several attacks, does the WAF stop at the first match or evaluate all of them?

Short answer

It evaluates all of them. TR7 WAF does not stop at the first match or at the moment the score reaches the threshold; it scans all of the path, query, header and body sections of the request, adds each signature hit and structural violation it finds as a separate record, and makes the blocking decision according to the total attack score after the scan is finished. A blacklist hit does not end the request immediately either; it is added as 100 points and the scan continues. The same signature is counted once in a single scanned value; if it is triggered in different parameters or in different request sections, each one adds a separate score. In a request that is recorded, all the triggered attacks are listed on the Attacks tab of the Event Logs preview. If the scan cannot be completed within the 2-second time limit, it is cut off; the request is blocked in Blocking mode (let through if Fail-open is on), and in Learning and Monitor modes, it is let through, except for one exception that can occur while the rules are being loaded.

How Does It Work?

1. Blacklist: A source address within the scope of Blacklist Protection is added as a 100-point violation; the request is not cut off.
2. Section-by-section scan: The path, query, header and body (JSON, XML, form or raw body) pass in order through the signature scan and the Check Fields inspections. Each signature hit and each structural violation is added as a separate record; each of multiple structural violations brings 24 points.
3. Repetitions: Even if a value is scanned both in its raw and in its URL-decoded form, the same signature is counted once for that value. If the same signature is triggered in two different parameters, two records are formed and the score is added twice.
4. Decision: Even if the score reaches the threshold during the scan, the scan continues; when the scan is finished, the total is compared with the OWASP Protection Level value (How does TR7 WAF decide whether to block a request?).

Example: At the default Very Tight level (threshold 4), if a signature with a High (6) score is triggered in the q parameter of a request and a signature with a Very High (8) score in its id parameter, and the request comes from an address on the blacklist, the total is 6 + 8 + 100 = 114. All three hits are recorded.

The parts that are not scanned are not an early stop:

• Requests within the scope of Do not WAF static contents or the Whitelist Condition do not enter the WAF at all.
• In fields whose OWASP Check switch is off, no signature scan is done (except in Learning mode); the signatures in the OWASP Exclusions list are not searched for in that field.
• The signatures in the Disabled state, and the signatures with a Low score while OWASP Protection Level is not Aggressive, are not scanned in any mode.
• In a request whose body exceeds the size that can be processed, the body is not scanned; if Block Unparsed Body is selected in the Block Unparsed Contents setting in the Raw field, this situation is added as a 24-point structural violation (Max. Body Size to Process).

Time limit: If the scan cannot be completed within the 2-second time limit, it is cut off and the WAF cannot make a decision about the request. The request is blocked in a group in Blocking mode (if Fail-open in the Request Body Limits window is on, it is let through without being scanned) and is not written to Event Logs; in Learning and Monitor modes, it is let through (the only exception is the scan being cut off while the WAF rules are being loaded and before the host group is determined: if the vService has a group in Blocking mode, this request is blocked (WAF Mode · Blocking Mode); What happens to a request if the scan exceeds a certain time (2-second scan limit)?).

Where Is It Seen in TR7?

• Left Monitor Panel → WAF-Protected vServices → vService → Event Logs is opened.
• The second number in the Attacks column of the list is the number of signatures triggered at the moment the record was created.
• The Attacks tab in the preview of the record shows each hit on a separate row with Attack Area and Attack Name; in a hit caught on a parameter, the @parameter suffix comes next to the field name.
• The total score is filtered with the WAF Score field in the Log Filter.

Common Misconceptions

• "The scan stops when the score reaches the threshold." The scan is completed; the decision is made at the end and all the hits are recorded.
• "The request of an address on the blacklist is not scanned." The request is scanned; the Blacklist Protection hit is added to the score together with the other violations.
• "The same attack is counted only once in a request." Repetitions in different parameters or in different request sections are counted separately.
• "A hit that does not appear on the Attacks tab has not been counted." An Event Logs record is written only for requests whose total reaches the threshold or that trigger a signature in the Monitor state; the hits of requests that stay below the threshold are never recorded.

How it is done in the documentation

• WAF · How Does It Work?
• WAF · Violation Scores
• Event Logs · Attacks Tab
• Event Logs · The Attacks Column

Related questions

• How does TR7 WAF decide whether to block a request?
• What is the attack score and how is it calculated?
• In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?