Can I change a signature's score (Low / Medium / High / Very High)?

Short answer

Yes. The built-in signature itself does not change; a change record is written on top of it. The rule is selected and Edit is clicked; in the Edit Rule Changes form, the Score switch is moved from the Keep Original position to the Change position, Low, Medium, High or Very High is selected and Accept is clicked; an intermediate value cannot be entered. A change made on the Signature & Rule Library screen is valid on all vServices, and one made on the OWASP Rules screen of the vService only on that vService. The score changes the contribution of the signature to the blocking threshold; in addition, since Low-score signatures are not scanned at protection levels other than Aggressive, a Low signature whose score is raised to Medium or above also starts to work at these levels. The change does not require recompilation and is undone with Restore to Default.

Problem: The Weight of the Signature Does Not Fit the Application

A signature takes part in the score with a weight higher or lower than the risk it represents in the application. Since changing the protection level affects all signatures, the goal is to adjust only the score of that signature.

The effect of the score on blocking with a single hit depends on the protection level (Score values and the protection level, blocking threshold):

Score	Points	Protection levels at which it blocks with a single hit
Low	2	Aggressive (not scanned at the other levels)
Medium	4	Very tight, Aggressive
High	6	Very tight, Aggressive
Very High	8	Tight, Very tight, Aggressive

At the Normal (16) and Elementary (24) levels, a single signature hit does not reach the threshold; for blocking, the scores of several hits are added up.

Solution: Three Methods

Your situation	Suitable method
The score of the built-in signature should change on all vServices	Method 1: Edit in Signature & Rule Library
The score of the built-in signature should change on only one vService	Method 2: Edit on the vService's OWASP rules screen
The score of a custom rule I added should change	Method 3: Edit Custom Rule

Method 1: Edit in Signature & Rule Library Recommended

• How it works The score change is written to the global layer and becomes valid on all vServices with WAF protection on; if a vService has separately changed the same field in its own layer, its own value remains on that vService.
• Where it is opened Configuration Menu → WAF → Signature & Rule Library → Edit
• Requirement WAF license; full permission in the WAF area
• Scope Device-wide

Step-by-Step Configuration

1

Adım 1 Open the library screen

The Configuration Menu is opened with the TR7 logo at the bottom left and WAF → Signature & Rule Library is clicked (how to access).

2

Adım 2 Find the signature

The ID or the name of the signature is written in the Search field.

3

Adım 3 Select the row

The row of the signature is checked with the box at the beginning of the row. Edit is enabled only while a single row is selected; it stays disabled for the structural inspection records and the IP Reputation record.

4

Adım 4 Open the edit form

Edit on the toolbar is clicked (it is also in the right-click menu of the row); the Edit Rule Changes window opens.

5

Adım 5 Change the score

The Score switch is moved from the Keep Original position to the Change position; the current value comes selected in the list that opens, and the new value is selected. The State and Inspection Scopes switches are left in the Keep Original position.

6

Adım 6 Save

Accept is clicked; there is no separate confirmation or deployment step. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Row and previewTR7 side

The row of the rule is written in italic and painted in a yellow tone; when the row is clicked, the preview is split into the Original rule and Edited rule columns, and the Score row is highlighted.

ExpectedThe new Score in the Edited rule column

2FilterTR7 side

In the Filter window, the Changed count in the Customizations group is examined.

ExpectedChanged increased by one

Method 2: Edit on the vService's OWASP Rules Screen

• How it works The same form writes to the vService layer; the score changes only on this vService. Since the screen knows the protection level of the vService, the Low signatures that are not scanned at this level appear as Low* in the Score column.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → the OWASP Rules link in the signature summary strip → Edit
• Requirement WAF protection on for the vService; modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the WAF screen of the vService

In the Left Monitor Panel, the WAF-Protected vServices tab is selected and the vService is clicked.

2

Adım 2 Open the OWASP Rules screen

On the WAF Management tab, the OWASP Rules → link at the bottom right of the signature summary strip is clicked; the OWASP Rules tab opens (how to access).

3

Adım 3 Find and select the signature

The ID or the name is written in the Search field and the row is checked.

4

Adım 4 Open the edit form

Edit on the toolbar is clicked; the Edit icon in the title of the preview that opens when the row is clicked also opens the same Edit Rule Changes window.

5

Adım 5 Change the score

The Score switch is moved to the Change position and the new value is selected; the other two switches are left at Keep Original.

6

Adım 6 Save

Accept is clicked; the change is applied without a deployment step and, in a cluster, goes to the peer device with the default auto-sync.

Verification

1OWASP Rules screenTR7 side

The Score column of the rule is examined; if the score of a signature that appeared with an asterisk while Low has been raised to Medium or above, the asterisk disappears and the Total Active Signatures value increases.

ExpectedNew Score, row in italic

Method 3: Edit Custom Rule

• How it works In a custom rule, the score is directly a field of the rule; no change record is written, and the rule is updated.
• Where it is opened The screen the custom rule was added on (Signature & Rule Library for a global rule, the OWASP rules screen of that vService for a vService-specific rule) → Edit
• Requirement Write permission in the layer of the rule
• Scope The layer of the rule

Step-by-Step Configuration

1

Adım 1 Select the custom rule

The row of the custom rule is checked; the IDs of global custom rules are in the 1,000,000–4,999,999 range, and the IDs of vService-specific rules in the 5,000,000–9,999,999 range.

2

Adım 2 Open the edit form

Edit is clicked; the Edit Custom Rule window opens with the current values of the rule (Rule Add Form).

3

Adım 3 Select the score

The new value is selected from the Score list.

4

Adım 4 Save

Accept is clicked; as long as the pattern does not change, the signature database is not recompiled.

Verification

1RowTR7 side

The Score column of the rule is examined.

ExpectedNew score

Common Mistakes

• Thinking that raising the score is the same as tightening the protection level. The score is the contribution of a single signature; the threshold is determined by the OWASP Protection Level setting of the vService.
• Assuming that a High score blocks on its own at the Tight level. High is 6 points; since the threshold of the Tight level is 8, a single High hit is not enough, and Very High is needed.
• Not noticing that a Low signature does not work. At levels other than Aggressive, Low signatures are not scanned; they are marked as Low* on the OWASP rules screen of the vService (How does the protection level affect what the OWASP Rules screen shows?).
• Trying to change the score of a global custom rule with Edit on the vService screen. A global custom rule is edited from Signature & Rule Library; on the vService screen, only its state is changed, with Change State.
• Trying to edit a structural inspection record. These rows are read-only; Edit stays disabled.

How it is done in the documentation

• Signature & Rule Library · Rule Edit Form
• Signature & Rule Library · Score Values and the Protection Level
• OWASP Rules · The Effect of the Protection Level on the View
• WAF · The Blocking Threshold

Related questions

• What is the OWASP Protection Level; how many levels are there?
• How does tightening the protection level affect false positives?
• If I change a built-in signature's score, state or scan scopes, how do I see the original (Original Rule / Edited Rule)?