How do I revert my changes to the default (Restore to Default)?

Short answer

The changed rule or rules are selected, Restore to Default is clicked and the confirmation question is accepted; the change record in the layer of the current screen is deleted and the rule returns to its values that come from the upper layer. The button is disabled if the selection does not contain at least one rule changed in that layer; it does not delete custom rules and does not reset the whole library. On the Signature & Rule Library screen, the rule returns to its built-in value. On the OWASP Rules screen of the vService, on the other hand, only the change of that vService is deleted and the rule returns to the value of the global layer; if the same rule has also been changed in the global layer, Restore to Default is also done in Signature & Rule Library to return to the built-in value. To revert individual fields, the switch of the related field in the Edit Rule Changes form is moved to the Keep Original position and Accept is clicked; if all three fields are set to Keep Original, the result is the same as Restore to Default.

Problem: A Signature Change Needs to Be Undone

A signature whose state, score or scope has been changed needs to be returned to its value from before the change. Since the changes are kept layer by layer, it must be known to which value an undo done on which screen will return the rule.

Solution: Two Methods

Your situation	Suitable method
All the changes in one or more rules are to be undone	Method 1: Restore to Default
Only some of the fields in a single rule are to be undone	Method 2: Keep Original in the Edit Rule Changes form

Method 1: Restore to Default Recommended

• How it works The change records of the selected rules in this layer are deleted; State, Score and Inspection Scopes start to come from the upper layer.
• Where it is opened The screen where the change was made (Signature & Rule Library or the OWASP Rules screen of the vService) → Restore to Default
• Requirement Full permission in the WAF area in Signature & Rule Library; modify permission in the WAF area on the vService screen
• Scope The layer of the current screen

Step-by-Step Configuration

1

Adım 1 Open the screen where the change was made

For a global change, Configuration Menu → WAF → Signature & Rule Library is opened; for a vService change, Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → the OWASP Rules link in the signature summary strip is opened (accessing OWASP Rules).

2

Adım 2 Find the changed rules

The rows changed in this layer are written in italic and colored in a yellow tone. The rules whose score or scope has been changed are filtered with Filter → Customizations → Changed; the rules in which only the state has been changed do not fall into this option and are recognized from the italic and yellow appearance of the row.

3

Adım 3 Select the rows

The rows to be restored are checked with the boxes at the beginning of the rows. If the selection also contains rules that have not been changed, they are not taken into the operation.

4

Adım 4 Start Restore to Default

Restore to Default on the toolbar is clicked (for a single rule, it is also in the right-click menu of the row). The Are you sure you want to delete the changes for the selected rules? They will revert to their original values. question appears.

5

Adım 5 Confirm

The confirmation question is accepted; the change records are deleted and this is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Row and previewTR7 side

The italic and yellow appearance of the row disappears; when the row is clicked, the preview opens with a single column.

ExpectedNo Original rule / Edited rule columns

2FilterTR7 side

The Filter → Customizations → Changed count is examined.

ExpectedDecreased by the number of rules whose score or scope was restored

Method 2: Keep Original in the Edit Rule Changes Form

• How it works Field-by-field undo: the change of the field moved to the Keep Original position is deleted, and the fields that stay at the Change position are kept. If all three fields are set to Keep Original, the change record is deleted entirely.
• Where it is opened The screen where the change was made → rule → Edit
• Requirement Write permission in the layer in which the rule was changed
• Scope The layer of the current screen

Step-by-Step Configuration

1

Adım 1 Select the rule

On the screen where the change was made, the row of the rule is checked; Edit is enabled only while a single row is selected.

2

Adım 2 Open the edit form

Edit on the toolbar is clicked. In the Edit Rule Changes window, the switches of the fields changed in this layer come at the Change position, and those of the others at the Keep Original position.

3

Adım 3 Revert the field

The switch of the field to be reverted (State, Score or Inspection Scopes) is moved to the Keep Original position; the selection list of the field disappears.

4

Adım 4 Save

Accept is clicked; the fields at the Keep Original position return to the value that comes from the upper layer.

Verification

1PreviewTR7 side

The row is clicked; since the reverted field shows the same value in the Original rule and Edited rule columns, it appears in a single cell and without highlighting.

ExpectedOnly the fields that stay at the Change position are highlighted

Common Mistakes

• Thinking that Restore to Default on the vService screen returns the rule to the built-in value. If there is a change in the global layer, the rule returns to it; for the built-in value, the global change is also removed from Signature & Rule Library.
• Trying to delete a custom rule with Restore to Default. Custom rules are not affected by this operation; they are deleted with Delete.
• Expecting the page type rules to be reset as well. Restore to Default covers only the changes in the signature library; there is a separate way for page types (How do I reset the rules to the default settings?).

How it is done in the documentation

• Signature & Rule Library · Restore to Default
• Signature & Rule Library · Rule Edit Form
• OWASP Rules · The Counterpart of the Operations on This Screen

Related questions

• If I change a built-in signature's score, state or scan scopes, how do I see the original (Original Rule / Edited Rule)?
• How do I reset the rules to the default settings?
• How do I assess whether a false positive fix creates a security gap?