Signature and Rule Library

Signatures, rule layers, custom rules and the OWASP Rules screen.

• What is a signature?WAF-05-001
• How many signatures / rules does TR7 WAF have?WAF-05-002
• Which attack categories do the signatures cover?WAF-05-003
• Where can I see the rules in the library?WAF-05-004
• What is the difference between a signature and a pattern; why are "Unique Signature Patterns" and "Total Active Signatures" different numbers?WAF-05-005
• In which parts of a request are signatures scanned (Path, Query, Header, JSON, XML, Form and Raw)?WAF-05-006
• Are cookies scanned?WAF-05-007
• What are the rule layers (built-in library, global layer, vService layer); which one takes precedence?WAF-05-008
• Can I disable a signature on a single vService only, rather than device-wide?WAF-05-009
• What does a signature's state (Enabled / Monitor / Disabled) mean?WAF-05-010
• Can I change a signature's score (Low / Medium / High / Very High)?WAF-05-011
• How do I add my own custom rule (regex)?WAF-05-012
• What is the "Inspection Scopes" field for when adding a custom rule?WAF-05-013
• How do I revert my changes to the default (Restore to Default)?WAF-05-014
• How do I try a new signature in production without risk (Monitor state)?WAF-05-015
• How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?WAF-05-016
• What does "Protected Target Types" mean?WAF-05-017
• What is Recompile and when is it needed?WAF-05-018
• What is the difference between the vService's OWASP Rules screen and the global Signature & Rule Library screen?WAF-05-019
• How does the protection level affect what the OWASP Rules screen shows?WAF-05-020
• Which regex syntax is supported in custom rules (backreference, lookaround); can I test a rule before saving it?WAF-05-021
• If my custom rule fails to compile, does the WAF keep protecting; how do I find out?WAF-05-022
• If I change a built-in signature's score, state or scan scopes, how do I see the original (Original Rule / Edited Rule)?WAF-05-023