Can I disable a signature on a single vService only, rather than device-wide?

Short answer

Yes. The operation is done not from the device-wide Signature & Rule Library screen but from the OWASP Rules screen of that vService: when the signature is selected and Disabled (first Monitor if a false positive is suspected) is selected with Change State, the change is written only to the layer of that vService; the other vServices and the global library are not affected. To disable the signature only on a specific page or parameter of the vService, the narrower way is to add the signature to the OWASP Exclusions list in the rule for that section or parameter of the relevant page type on the Page Types screen. Both changes are applied without a separate deployment step and do not require the signature database to be recompiled; the state change is undone with Restore to Default.

Problem: A Signature Produces False Positives on Only One Application

A signature catches the legitimate requests of a single application. Turning off the signature device-wide also removes the protection from the other applications that the same signature protects; for this reason, the change needs to stay only on the relevant vService or the relevant page.

Solution: Two Methods

The methods are alternatives to each other; it is not necessary to apply both of them for the same signature.

Your situation	Suitable method
The signature must not work anywhere on this vService	Method 1: Change State in the vService layer
The signature must be off only on a specific page or parameter	Method 2: OWASP exclusions in the page type
The false positive appears in Event Logs; I want to teach it with a single click	Allow / Teach: How do I allow a request that was blocked by mistake?

Method 1: Change State in the vService Layer Recommended

• How it works The state of the selected signatures changes only in the layer of this vService. A Disabled signature is not scanned at all on this vService; a Monitor signature is scanned and recorded but does not take part in the score.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → the OWASP Rules link in the signature summary strip → Change State
• Requirement WAF protection on for the vService; modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the WAF screen of the vService

In the Left Monitor Panel, the WAF-Protected vServices tab is selected and the vService is clicked; the screen opens with the Dashboard tab of the vService.

2

Adım 2 Go to the WAF Management tab

The WAF Management tab is clicked.

3

Adım 3 Open the OWASP Rules screen

The OWASP Rules → link at the bottom right of the signature summary strip below the mode cards is clicked; the OWASP Rules tab opens (how to access). A change made on this screen affects only this vService.

4

Adım 4 Find the signature

The ID or the name of the signature is written in the Search field above the table. The ID is seen in the Attack ID row on the Attacks tab of the Event Logs record (Attacks tab).

5

Adım 5 Select the row

The row of the signature is checked with the box at the beginning of the row; more than one signature can be selected together.

6

Adım 6 Open the Change State window

Change State on the toolbar is clicked; the Change State window opens. The same window also opens from the right-click menu of the row and from the Change State icon in the title of the preview that opens when the row is clicked. If the selection contains only structural inspection records or the IP Reputation record, the button is disabled; these records are read-only.

7

Adım 7 Select the new state

Disabled is selected in the New State field; if whether the signature is really unnecessary is to be observed first, Monitor is selected. The field comes with Enabled selected each time it opens.

8

Adım 8 Save

Accept is clicked; no separate confirmation window opens and the change is applied without a deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

With the Edit form

If the score or the scopes also need to change along with the state, the row is selected and Edit is clicked; in the Edit Rule Changes form, the State switch is moved from the Keep Original position to the Change position, Disabled is selected and Accept is clicked (Rule Edit Form). The result is written to the same layer.

Verification

1OWASP Rules screenTR7 side

The row of the rule is examined: a row changed in this layer is written in italic and painted in a yellow tone; a Disabled row appears pale. When the row is clicked, the preview is split into the Original rule and Edited rule columns, and the State row is highlighted.

ExpectedState: Disabled · two-column preview

2Global screenTR7 side

The same ID is searched for in Configuration Menu → WAF → Signature & Rule Library.

ExpectedState unchanged

Method 2: OWASP Exclusions in the Page Type

• How it works Only in the selected section or parameter of the selected page type is the signature not searched for; it continues to work on the other pages and parameters of the same vService.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → the N page types row of the host group → page type → section tab
• Requirement WAF protection on for the vService; modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Determine the location of the attack

On the Attacks tab of the Event Logs record, the Corresponding rule (matching page type), Attack area (section) and Argument (parameter) rows are examined.

2

Adım 2 Open the Page Types list

On the WAF Management tab, the N page types row of the host group is clicked; the Page Types tab opens (accessing the screen).

3

Adım 3 Select the page type

The page type in the Corresponding Rule row (for requests that do not match any page type, the italic Any Paths row) is clicked; the detail panel opens on the right.

4

Adım 4 Switch to the section tab

On the tab strip of the panel, the tab that corresponds to the section of the attack (Query, Header, JSON, Xml, Form or Raw) is clicked (Path Check Fields).

5

Adım 5 Open the rule form of the parameter

In the Argument table, if the parameter is this page type's own rule (bold), the row is clicked and Edit above the detail is clicked. If the parameter is not in the table or appears in italic (inherited), Add Argument Rule for … (e.g. Add Argument Rule for Query) above the table is clicked and the name of the parameter is written in the Argument Name field. If the exclusion is to be applied to all the parameters in the section, the Edit Common Rule for … button of the common rule (Add Common Rule for … if the section is inherited) is used instead.

6

Adım 6 Add the signature to the exclusions

The OWASP Check box is left checked; in the OWASP Exclusions field that appears while the box is checked, the signature is selected by its name (Query · OWASP Exclusions). The number of exclusions in a field is limited by the Max. OWASP Exclusions setting (What does the "Max. Owasp Exclusions" setting do; what happens if the limit is exceeded?).

7

Adım 7 Save

The form is saved with the Edit button when editing and with the Add button when adding; there is no separate deployment step. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Detail panelTR7 side

On the relevant tab of the page type, the OWASP check row of the parameter is examined.

ExpectedThe number of exclusions next to the ✓ mark

2Event LogsTR7 side

A request is sent to the same page with the same parameter and Event Logs is examined.

ExpectedNo record for this signature on this parameter

Common Mistakes

• Doing the disabling in Signature & Rule Library. A change on the global screen is applied to all vServices with WAF protection on.
• Setting it directly to Disabled. Since a Disabled signature is not scanned at all, it also produces no records; if it is not certain that the signature is unnecessary, the hits are first monitored with Monitor (How do I try a new signature in production without risk (Monitor state)?).
• Looking for Edit on an inherited (italic) parameter row. The inherited row is edited only from the rule it comes from (most often Any paths); for an exclusion specific to the page type, a separate argument rule is added in that page type.
• Unchecking the OWASP check box and thinking an exclusion has been added. When the box is unchecked, all signatures are disabled in that field; for a single signature, the box is left checked and OWASP exclusions is used (Is it better to disable a signature entirely or to add an OWASP exclusion?).

How it is done in the documentation

• OWASP Rules · The Counterpart of the Operations on This Screen
• Signature & Rule Library · Change State Form
• Query · OWASP Exclusions
• Event Logs · Attacks Tab

Related questions

• Is it better to disable a signature entirely or to add an OWASP exclusion?
• How do I fix the same false positive on several vServices at once (global layer)?
• Can I turn off OWASP scanning for a specific parameter?