How do I try a new signature in production without risk (Monitor state)?

Short answer

The signature is run in the Monitor state: a new custom rule is added by selecting State = Monitor in the Add Custom Rule window, and an existing signature is taken into Monitor with Change State. A signature in the Monitor state is scanned and each of its matches is written to the Event Logs record with its real score, but its score is not added to the total; for this reason, it does not block any request on its own (State values). For a while, only the records of this signature are reviewed in Event Logs with the Signature tab of the filter strip; if there is no match in legitimate requests, the state is set to Enabled. If the operation is done on the Signature & Rule Library screen, it is valid on all vServices; if it is done on the OWASP Rules screen of the vService, it is valid only on that vService. For the trial, the host group must be in Monitor or Blocking mode; in Learning mode, no Event Logs record is produced.

Problem: A New Signature May Block Legitimate Traffic

A new custom rule, or a signature that was previously off, is to be taken into production. If the pattern also catches legitimate requests, these matches need to be seen before users are blocked.

Solution: Two Methods

Your situation	Suitable method
I am adding a new custom rule	Method 1: Add in the Monitor state
I want to try an existing signature (built-in or custom)	Method 2: Take the existing signature into Monitor
Not a single signature but the whole rule set of the host group is to be tried	Put the host group into Monitor mode: How do I use Monitor mode to weed out false positives?

Method 1: Add in the Monitor State Recommended

• How it works From the first moment, the rule records its matches but does not block any request.
• Where it is opened Signature & Rule Library or the OWASP Rules screen of the vService → Add
• Requirement Write permission in the layer to which the rule will be added; on the vServices to be tested, the host group in Monitor or Blocking mode
• Scope All vServices in Signature & Rule Library, only that vService on the OWASP Rules screen

Step-by-Step Configuration

1

Adım 1 Open the add form

According to the layer of the rule, Configuration Menu → WAF → Signature & Rule Library or the OWASP Rules screen of the vService is opened and Add on the toolbar is clicked; the Add Custom Rule window opens.

2

Adım 2 Define the rule

The Name, Description, Score, Inspection Scopes and Pattern (Regex) fields are filled in and the pattern is tried without saving (How do I add my own custom rule (regex)?).

3

Adım 3 Set the state to Monitor

In the State list, Monitor is selected instead of the default Enabled.

4

Adım 4 Save

Accept is clicked; the rule is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

5

Adım 5 Open the Event Logs screen

Left Monitor Panel → WAF-Protected vServices → the vService is selected and the Event Logs tab is clicked (accessing Event Logs).

6

Adım 6 Filter only the records of this signature

On the filter strip above the table, the Signature tab is opened and the name of the rule is selected.

7

Adım 7 Examine the records

A row is clicked; on the Attacks tab of the preview, the matched content and the score of the signature are seen. If no other signature blocked the request, the verdict of the record appears as Not blocked — Below the blocking threshold; if the host group is in Monitor mode, the verdict is Not blocked — Monitor mode. If the matches include legitimate requests, the pattern or the scopes are narrowed.

8

Adım 8 Put the rule into effect

On the library screen, the row of the rule is checked, Change State is clicked, New State = Enabled is selected and Accept is clicked.

Verification

1Rule listTR7 side

The State column of the rule and the Monitor count in the State card at the top are examined.

ExpectedState: Monitor (yellow)

2Matching requestClient and TR7 side

A request that matches the pattern is sent and Event Logs is examined.

ExpectedThe request gets a normal response · there is a record in Event Logs

Method 2: Take the Existing Signature into Monitor

• How it works The score of the existing signature is taken out of the total; its matches continue to be recorded.
• Where it is opened Signature & Rule Library or the OWASP Rules screen of the vService → Change State
• Requirement Write permission in the layer in which the change will be made
• Scope All vServices in Signature & Rule Library, only that vService on the OWASP Rules screen

Step-by-Step Configuration

1

Adım 1 Find and select the signature

On the library screen, the ID or the name of the signature is written in the Search field and the row is checked.

2

Adım 2 Open the Change State window

Change State on the toolbar is clicked.

3

Adım 3 Select Monitor

In the New State field, Monitor is selected; the field comes with Enabled selected at every opening.

4

Adım 4 Save

Accept is clicked; the change is applied without a confirmation being asked.

5

Adım 5 Monitor and put into effect

Steps 5–8 of Method 1 are followed; if the signature is a built-in signature, Restore to Default can also be used to return to Enabled.

Verification

1Rule listTR7 side

The State column of the rule is examined; for a built-in signature, the row is shown in italic and colored in a yellow tone.

ExpectedState: Monitor

Common Mistakes

• Confusing the Monitor state with Monitor mode. The state takes a single signature out of the score; the mode runs the whole rule set of the host group without blocking (What does the WAF do in Monitor mode?).
• Doing the trial in a host group in Learning mode. In Learning mode, the matches go to the learning record and no Event Logs record is produced; the trial is done in a group in Monitor or Blocking mode.
• Thinking that a Monitor signature can never get the request blocked. If the score of the Enabled signatures in the same request reaches the threshold, the request is blocked (In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?).
• Doing the trial with a Low score. If the protection level is not Aggressive, signatures with a Low score are not scanned even in the Monitor state; for the trial, a score of Medium or above is selected.

How it is done in the documentation

• Signature & Rule Library · State Values and Their Counterpart in the Traffic
• WAF · The Three Situations That Do Not Enter the Score
• Event Logs · The Filter Strip
• Event Logs · The Action Values

Related questions

• How do I use Monitor mode to weed out false positives?
• In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?
• What does the WAF do in Monitor mode?