What does a signature's state (Enabled / Monitor / Disabled) mean?

Short answer

State takes three values. Enabled: the signature is scanned and, when it matches, its score is added to the total score of the request; if the total reaches the OWASP Protection Level threshold of the vService, the request is blocked. Monitor: the signature is scanned and each of its matches is written to the Event Logs record with its real score, but its score is not added to the total; on its own, it blocks no request. Disabled: the signature is not scanned at all; no match is searched for and no record is produced. The state belongs to a single rule and does not override the WAF Mode setting of the host group: in a host group in Monitor mode or in Learning mode, even an Enabled signature does not block the request. The (Faulty) suffix appears next to the state of a rule that cannot be compiled (it is filtered with the Faulty option in the Filter window); that rule is not applied.

How Does It Work?

	Enabled	Monitor	Disabled
Is it scanned	Yes	Yes	No
Is its score added to the total	Yes	No (it appears in the record with its real score)	-
Event Logs record	If the total score reaches the threshold	On every match	None
Does it block on its own	Yes, if its score reaches the threshold (e.g. Medium and above at the default Very Tight level)	No	No
Appearance in the list	Green in the State column	Yellow (amber) in the State column	Gray in the State column; the row is pale

• When a signature in the Monitor state matches and the request has not been blocked, the decision of the record appears as Not blocked — Below the blocking threshold; if the host group is in Monitor mode, the decision is Not blocked — Monitor mode (Action values). If the score of the Enabled signatures in the same request reaches the threshold, the request is still blocked.
• If the protection level is not Aggressive, Low-score signatures are not scanned even if their state is Enabled or Monitor (How does the protection level affect what the OWASP Rules screen shows?).
• While the host group is in Learning mode, Disabled signatures are still not scanned; the matches of Enabled and Monitor signatures are written not to Event Logs but to the learning log.
• The state is changed from the Change State window or from the Edit form; the change does not require the signature database to be recompiled. If it is made on the Signature & Rule Library screen, it is valid on all vServices; if it is made on the OWASP rules screen of the vService, it is valid only on that vService.
• A rule whose only change is its state appears in italic and in color in the list, but in the Filter → Customizations group it is counted not as Changed but as Unchanged; the state breakdown is followed from the State group.
• In the Filter → State group, the rules that cannot be compiled are gathered in a separate Faulty option; on the State card, on the other hand, they are counted under their own states (If my custom rule fails to compile, does the WAF keep protecting; how do I find out?).
• Using the Monitor state to try a new signature: How do I try a new signature in production without risk (Monitor state)?

Common Misconceptions

• "A signature in the Monitor state works like Monitor mode." The state removes a single signature from the score; Monitor mode, on the other hand, runs the entire rule set of the host group without blocking (What does the WAF do in Monitor mode?).
• "A Disabled signature takes part in learning in Learning mode." A Disabled signature is not scanned in any mode.
• "An Enabled signature produces a record on every match." Enabled hits are not written to Event Logs unless the total score reaches the threshold; only signatures in the Monitor state produce a record on every match.

How it is done in the documentation

• Signature & Rule Library · State Values and Their Counterpart in the Traffic
• WAF · The Three Situations That Do Not Enter the Score
• Event Logs · Under Which Condition Is the Log Produced?
• WAF Mode · Runtime Behavior of the Modes

Related questions

• In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?
• What does the WAF do in Monitor mode?
• What do the Action values in Event Logs mean?