What is the difference between a signature and a pattern; why are "Unique Signature Patterns" and "Total Active Signatures" different numbers?

Short answer

A pattern is a row in the table and carries a single regular expression and its settings. A signature is the form of that pattern that works in a single request section. If a rule has selected four scopes in the Inspection Scopes field, it is a single row in the table but counts as four signatures; the Signatures column shows this number. For this reason, Unique Signature Patterns is the number of rows in the list, while Total Active Signatures is the sum of the scope counts of all the rows. When there are no custom rules, the Signature & Rule Library screen shows 3,347 rows and 10,370 signatures; the structural inspection records and the IP Reputation record take part in these numbers as one row and one signature each. The pattern is compiled once, independently of the number of scopes; the scope list determines against the content of which sections the pattern will be scanned.

How Does It Work?

Value	What it counts	Device-wide (with no custom rules)
Unique Signature Patterns	The number of rows in the list: signature rules, structural inspection records, the IP Reputation record and custom rules	3,347 (3,294 signature rules + 53 inspection records)
Total Active Signatures	The sum of the scope counts of every row	10,370 (10,317 + 53)
Signatures column	The scope count of a single row	E.g. a rule with Query, Form, JSON and Raw selected → 4; always 1 in the inspection records

• The Active, Monitor and Disabled values in the State card count rows; their sum is equal to the Unique Signature Patterns value (library summary cards).
• The three values in the title of the Filter window (Total Active Signatures, Unique Signature Patterns, Customizations) are independent of the filter selection; they are calculated from the whole rule set of the screen; the first two are the same as the values in the top strip. In the classification groups, the number next to an option is the signature count.
• Adding or removing a scope changes the signature count; it does not cause the pattern to be compiled again (What is the "Inspection Scopes" field for when adding a custom rule?).
• On the vService's OWASP Rules screen, the Low-scored rules that the protection level does not scan are subtracted from both values (How does the protection level affect what the OWASP Rules screen shows?).

Common Misconceptions

• "Every signature is compiled separately." The pattern is compiled once; the scope determines only in which section it is taken into account.
• "Total Active Signatures counts only Enabled signatures." The value is independent of the state; Monitor and Disabled rules are also counted.
• "Unique Signature Patterns counts only signature rules." The read-only structural inspection records and the IP Reputation record are also rows in the list and enter the count.

How it is done in the documentation

• Signature & Rule Library · The Distinction Between the Signature and the Pattern
• Signature & Rule Library · The Library Summary Cards
• Signature & Rule Library · Inspection Scopes

Related questions

• How many signatures / rules does TR7 WAF have?
• In which parts of a request are signatures scanned (Path, Query, Header, JSON, XML, Form and Raw)?
• What is the "Inspection Scopes" field for when adding a custom rule?