How many signatures / rules does TR7 WAF have?

Short answer

When there are no custom rules, the top strip of the Signature & Rule Library screen shows the Unique Signature Patterns value as 3,347 and the Total Active Signatures value as 10,370. 3,294 of these rows are signature rules; since every rule is counted as a separate signature for every request section in its Inspection Scopes list, the signature rules amount to 10,317 signatures. The remaining 53 rows are read-only inspection records (52 structural inspection records and the IP Reputation record), and each of them counts as 1 signature; the difference between the value on the screen and the number of signature rules comes from these records. The signature rules are mapped to 32 attack categories, 120 CWE, 40 CAPEC and 33 MITRE techniques (29 ATT&CK, 4 ATLAS) and 33 protected platforms; the ten items of OWASP Top 10 Web and the API1–API9 items of OWASP Top 10 API are covered by signatures, and API10 by the structural inspection records (library summary cards). The numbers change with the software version and with the custom rules added; the current value on the device is read from the screen.

Numbers

When there are no custom rules, the Signature & Rule Library screen shows the values below. The 53 read-only inspection records also enter the row and signature counts on the screen; the last column gives only the share of the signature rules.

Card	On the screen (with no custom rules)	Signature rules only
Unique Signature Patterns (rows)	3,347	3,294
Total Active Signatures (rows × scopes)	10,370	10,317
Signature Categories	36	32 attack categories
CWE Coverage	129	120
CAPEC Coverage	41	40
MITRE ATT&CK Coverage (during and after the attack)	33	33
Protected Target Types	33	33
OWASP Web Coverage	10/10	10/10
OWASP API Coverage	10/10	9/10 (API1–API9; API10 only from the structural inspection records)

By scope, the signature rules amount to the following number of signatures: Query 2,824 · Form 2,775 · JSON 1,830 · Raw 937 · Path 828 · Header 711 · XML 412. By score, the signature rules are distributed as follows: Very High 1,978 rules (including the three 9-point rules) · High 963 · Medium 218 · Low 135.

• The structural inspection records and the IP Reputation record are one row each in the list and count as 1 in the Signatures column; they are not signatures but the catalog counterparts of inspections configured on other screens (Which attack categories do the signatures cover?).
• Every custom rule added increases the Unique Signature Patterns value by 1 and the Total Active Signatures value by the number of scopes it selects; since custom rules are written to the Custom Rules category, Signature Categories also increases by one with the first custom rule.
• On the vService's OWASP Rules screen and in the signature summary strip on the WAF Management tab, the Low-scored rules that the protection level does not scan are subtracted from the numbers; at the default Very tight level, 135 rules (463 signatures) are subtracted (How does the protection level affect what the OWASP Rules screen shows?).
• The effect of the rule count on latency: Does latency grow as the number of rules grows?

Common Misconceptions

• "The signature count is the rule count." A rule is counted as a separate signature in every selected scope (What is the difference between a signature and a pattern; why are "Unique Signature Patterns" and "Total Active Signatures" different numbers?).
• "Total Active Signatures counts only Enabled signatures." The value is independent of the state; Disabled and Monitor rules are also counted. Only in the vService view are the Low-scored rules that the protection level does not scan subtracted.
• "The numbers are fixed." They change with the software version, and custom rules also enter the count; the cards on the screen are calculated from the loaded set at every opening.

How it is done in the documentation

• Signature & Rule Library · The Library Summary Cards
• Signature & Rule Library · The Distinction Between the Signature and the Pattern
• WAF · Protection Strength

Related questions

• What is the difference between a signature and a pattern; why are "Unique Signature Patterns" and "Total Active Signatures" different numbers?
• Which attack categories do the signatures cover?
• Does latency grow as the number of rules grows?