What does "Protected Target Types" mean?

Short answer

Every signature is labeled with the technology or the component it targets; Protected Target Types is the list of these labels. There are 33 platform labels in the library (e.g. Web Application, Web Server, Sql Database, Java Runtime, Api Endpoint, Ai Llm Service, Websocket Service). The Protected Target Types card on the Signature & Rule Library screen shows how many different platforms the library covers; the Protected Target Types group in the Filter window filters the rules mapped to certain platforms; the Classification tab of the preview and the Protected Targets column, hidden by default, show the platforms of a single rule. The label is only for classification: it does not restrict the scan, and the signature runs in the selected scopes independently of the technology the application uses.

How Does It Work?

Where	What it shows
Protected Target Types card	The number of unique platforms the rules in the library are mapped to (library summary cards)
Filter → Protected Target Types	The rules mapped to the selected platforms; the number next to the option is the number of signatures (rule × scope)
Protected Targets column	The platforms of the rule; it is hidden by default and is opened with Columns
Preview → Classification	The platforms of the selected rule (How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?)
Event Logs	The Target field in the filter strip and in the record preview; target in the SIEM record (Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?)

The platforms and the number of records mapped to each of them are given in the table below. The numbers cover the built-in signature rules and the inspection records; a rule can be mapped to more than one platform. In the Filter window, on the other hand, not the number of rules but the number of signatures (rule × scope) appears next to the platform name; e.g. 6,310 is written next to Web Application.

Platform	Rules
Web Application	2,117
Web Server	529
Sql Database	465
File System	410
Operating System	400
Shell Interpreter	354
Application Server	224
Java Runtime	205
Api Endpoint	199
Template Engine	158
Serial Engine	131
Internal Network	118
Xml Parser	108
Expr Evaluator	101
Ldap Directory	78
Nosql Database	74
Nodejs Runtime	65
File Upload Handler	57
Php Runtime	46
Python Runtime	43
Dotnet Runtime	25
Reverse Proxy	23
Cloud Service	22
Metadata Service	19
Ai Llm Service	16
Auth System	15
Api Gateway	6
Rag Pipeline	6
Session Manager	3
Cache Server	2
Ai Tooling Service	2
Saml Service	2
Websocket Service	1

• The label is only for classification: in an application that does not use Java, the signatures labeled Java Runtime are still scanned. To narrow the scan, the state or the scopes of the signature are changed (Can I disable a signature on a single vService only, rather than device-wide?).
• Attacks against artificial intelligence services are marked with the Ai Llm Service, Rag Pipeline and Ai Tooling Service labels (Can it catch prompt injection attacks against my LLM / AI services?).
• In custom rules, the platform field is empty; it cannot be entered manually.

Common Misconceptions

• "If a platform is selected, only those signatures run." Filter only narrows the list; it does not affect the scan.
• "The label automatically detects the technology of the application." The label defines the target of the signature; it does not make any detection about the protected application.
• "The card shows the number of signatures per platform." The card shows the number of unique platforms; the number of signatures per platform appears in the Filter window, next to the platform name.

How it is done in the documentation

• Signature & Rule Library · Protected Target Types
• Signature & Rule Library · The Library Summary Cards
• WAF · What Is the Classification Good For?

Related questions

• How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?
• Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?
• Can it catch prompt injection attacks against my LLM / AI services?