Which attack categories do the signatures cover?

Short answer

The built-in signature rules are divided into 32 attack categories: SQL Injection, Cross-Site Scripting, OS Command Execution, Template/Expression Eval, Arbitrary File Read, Data Query Injection, Directory/Path Traversal, Server-Side Request Forgery, Malicious Code Detection, Insecure Deserialization, Information Disclosure, Encoding Evasion, XML External Entity, File Write/Upload, CRLF / Header Injection, CSV Formula Injection, Access Control Bypass, Open Redirect, File Inclusion, Application DoS, Prototype Pollution, Format String Attack, Input Validation/Neutralization, Unsafe Reflection, LLM Prompt Injection, SSI Injection, Authentication Bypass, Business Logic Abuse, HTTP Request Smuggling, Parameter Pollution, Session Manipulation and Cache Poisoning (Signature Categories). The list also contains the four categories of the read-only inspection records that are not signatures (Structure Limits, Structure Policies, Content Integrity, IP Reputation) and the Custom Rules category, to which custom rules are written. The category is seen on the Signature & Rule Library screen in the Signature Category column, which is hidden by default, in the Signature Categories group in the Filter window and on the Signature Categories card.

Categories

The table is sorted by rule count; the Signature column is the sum of the scope counts of the rules and corresponds to the number next to the category name in the Filter window.

Category	Rule	Signature
SQL Injection	489	1,498
Cross-Site Scripting	438	1,197
OS Command Execution	373	1,079
Template/Expression Eval	297	1,066
Arbitrary File Read	205	756
Data Query Injection	201	609
Directory/Path Traversal	147	523
Server-Side Request Forgery	140	447
Malicious Code Detection	134	446
Insecure Deserialization	132	533
Information Disclosure	107	275
Encoding Evasion	69	233
XML External Entity	69	271
File Write/Upload	62	157
CRLF / Header Injection	59	160
CSV Formula Injection	56	154
Access Control Bypass	48	108
Open Redirect	37	73
File Inclusion	34	145
Application DoS	33	73
Prototype Pollution	29	105
Format String Attack	26	48
Input Validation/Neutralization	20	80
Unsafe Reflection	20	62
LLM Prompt Injection	16	66
SSI Injection	16	56
Authentication Bypass	11	33
Business Logic Abuse	10	29
HTTP Request Smuggling	8	15
Parameter Pollution	3	9
Session Manipulation	3	8
Cache Poisoning	2	3

Categories of the Inspection Records

Category	Records	Where it is configured
Structure Limits	28	The size, length, count and depth limits in the page types (Path Check Fields)
Structure Policies	19	The required and allowed field lists, value patterns, allowed methods, keys that block the body type, and MIME type lists in the page types
Content Integrity	5	The body parsing inspections in the page types (invalid JSON/XML/form body, body that cannot be decoded, unexpected parsing error)
IP Reputation	1	Source IP in the blacklist; applied while Blacklist Protection is on in the vService (list sources: IP Intelligence & Reputation and the vService's Frontend Blacklist field)
Custom Rules	The number of custom rules added	Add in Signature & Rule Library and on the vService's OWASP rules screen

• The inspection records appear in the list as Structure or Blacklist in the Type column; they cannot be edited, their states cannot be changed and they cannot be deleted.
• The Signature Categories card counts the categories that carry rules: 36 when there are no custom rules (32 attack categories and 4 inspection record categories), 37 with the first custom rule. On the vService's OWASP Rules screen, the Low-scored rules that the protection level does not scan are subtracted, so at the default Very Tight level the card shows 35: both rules in the Cache Poisoning category are Low-scored.
• The same category names are used in the Event Logs filter strip and in the reports (How do I filter logs by fields such as IP, country, ASN, path, signature, category, OWASP and CWE?).

Common Misconceptions

• "Structure Limits is a signature category." These records are the catalog counterparts of the structural inspections; they carry no pattern and cannot be edited from the list.
• "The category list also covers volumetric and bot attacks." These attacks are handled by Bot/DDoS Protection.
• "The number in the Filter window is the rule count." In the category groups, the number is the signature (rule × scope) count.

How it is done in the documentation

• Signature & Rule Library · Signature Categories
• Signature & Rule Library · Filter
• Signature & Rule Library · The Library Summary Cards
• WAF · Protection Strength

Related questions

• Which attacks does TR7 WAF protect against?
• Is there protection against SSRF and cloud metadata (169.254.169.254) access attempts?
• How do I filter logs by fields such as IP, country, ASN, path, signature, category, OWASP and CWE?