What is a signature?

Short answer

A signature is a known attack pattern that the WAF searches for in the request. Every signature consists of a regular expression (regex), the request sections in which the pattern is searched for (Inspection Scopes: Path, Query, Header, Form, JSON, XML, Raw), the weight added to the attack score when it matches (Score: Low, Medium, High, Very High) and the state (State: Enabled, Monitor, Disabled). The decision is made by score: the scores of the signatures that match in a request are summed and, when the total reaches the OWASP Protection Level threshold selected on the vService, the request is blocked; if the score of a single hit reaches the threshold, that hit is enough on its own. The built-in signatures are listed on the device-wide Signature & Rule Library screen, and custom rules of one's own can be added to it. Signatures are a negative security model that recognizes known attacks; the structural inspections in the page types (positive security model) complement it.

How Does It Work?

1. The WAF splits the request into seven sections (path, query, header, form, JSON, XML, raw body). A section or parameter enters signature scanning if the OWASP Check setting is on in the page type that the request matches; while the host group is in Learning mode, it is scanned independently of this setting.
2. Every section is scanned with the signatures whose Inspection Scopes list contains that section. Disabled signatures are not scanned at all; if the protection level is not Aggressive, signatures with a Low score are also not scanned.
3. The score of every matching Enabled signature is added to the total score of the request. A signature in the Monitor state is recorded with its real score but is not added to the total.
4. When the total score reaches the threshold of the protection level, the request is blocked if the host group is in Blocking mode; in Monitor mode, it is passed and recorded.
5. When the total reaches the threshold or a signature in the Monitor state matches, an Event Logs record is written; Enabled hits that stay below the threshold do not produce a record.

The Parts of a Signature

Part	Description	Where it is seen
Pattern	The regular expression that recognizes the attack	Not shown in the interface for built-in signatures; in a custom rule, the Pattern (Regex) field
Scopes	The request sections in which the pattern is searched for	Inspection Scopes in the rule form (Path, Query, Header, Form, JSON, XML, Raw); in the list, the Signatures column shows the number of scopes, and in the preview, Active Signature Fields shows the scope names (URI Path, Query String, HTTP Headers, Form Data, JSON Body, XML Body, Raw Body)
Score	Low, Medium, High, Very High (their numeric values are 2, 4, 6, 8; the three 9-point rules in the built-in library also appear as Very High)	Score column
State	Enabled, Monitor, Disabled	State column
Classification	Attack category, CWE, CAPEC, MITRE ATT&CK, OWASP Web, OWASP API, protected platform	Signature Category column, Classification tab in the preview
ID	Below 1,000,000 for built-in signatures; 1,000,000–4,999,999 for global custom rules, 5,000,000–9,999,999 for vService-specific custom rules	ID column

Signatures in TR7

• On the Signature & Rule Library screen, when there are no custom rules, 3,347 rows (3,294 signature rules and 53 read-only inspection records) and 10,370 signatures appear; the breakdown of the numbers: How many signatures / rules does TR7 WAF have?
• The state, score and scopes of a signature can be changed; its pattern, name and classification cannot be changed (Rule Edit Form).
• The change is made device-wide from the Signature & Rule Library screen, and for a single vService from the OWASP Rules screen of that vService: What are the rule layers (built-in library, global layer, vService layer); which one takes precedence?
• How the score turns into blocking: How does TR7 WAF decide whether to block a request?
• The difference between the signature count and the pattern count: What is the difference between a signature and a pattern; why are "Unique Signature Patterns" and "Total Active Signatures" different numbers?

Common Misconceptions

• "When a signature matches, the request is blocked." The score of the hit is added to the total; the blocking decision is made by the total score and the threshold of the protection level.
• "Signatures search only in the URL." Every signature is searched for in each of the sections in its Inspection Scopes list.
• "A Low-scored signature is working, since it appears as Enabled." If the protection level is not Aggressive, Low signatures are not scanned (How does the protection level affect what the OWASP Rules screen shows?).

How it is done in the documentation

• Signature & Rule Library · What Is Signature & Rule Library?
• Signature & Rule Library · The Distinction Between the Signature and the Pattern
• WAF · The Blocking Threshold
• WAF · Two Security Models

Related questions

• What is the difference between the negative security model (signature scanning) and the positive security model?
• What are the basic building blocks of TR7 WAF (WAF Mode, Virtual Host Group, Page Types, Any Paths, Check Fields, Signature)?
• What is the OWASP Protection Level; how many levels are there?