What is the difference between the vService's OWASP Rules screen and the global Signature & Rule Library screen?

Short answer

The two screens use the same cards, table, toolbar and forms; their difference is the scope and the layer they edit (What Is OWASP Rules?). Signature & Rule Library is opened through Configuration Menu → WAF → Signature & Rule Library; it edits the global layer, lists the built-in library together with the global layer, and every change here affects all the vServices with WAF protection enabled; a change requires full permission in the WAF area. OWASP Rules, on the other hand, is opened from the signature summary strip on the WAF Management tab of a vService; it edits the layer of that vService, also adds the rules specific to that vService (ID 5,000,000 and above) to the list, and its changes are valid only on that vService; modify permission in the WAF area is enough. Only the vService screen knows the OWASP Protection Level setting, and it marks the Low signatures that are not scanned at this level with an asterisk and subtracts them from the counts; the operation icons in the preview title are enabled only there; there, Restore to Default returns the rule not to the built-in value but to the value of the global layer. Recompile produces the whole signature database of the device again on both screens.

Comparison

	Signature & Rule Library	OWASP Rules (vService)
How it is opened	Configuration Menu → WAF → Signature & Rule Library	Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → the OWASP Rules link in the signature summary strip; the Total Active Signatures row in the vService preview
Layer that is edited	Global	This vService
What is listed	Built-in library + global layer	Built-in library + global layer + the layer of this vService
Effect of the change	All the vServices with WAF protection enabled	Only this vService
Permission to change	Full permission in the WAF area	Modify permission in the WAF area; on an account with a vService restriction, only on its own vServices
Effect of the protection level	Not shown; Low signatures are counted as well	Low signatures that are not scanned are subtracted from the counts, Low* in the Score column (How does the protection level affect what the OWASP Rules screen shows?)
Italic and colored rows	Rules added or changed in the global layer	Rules added or changed in the layer of this vService; global changes without color
Filter → Customizations	Counts the customizations in the global layer	Counts only the customizations of this vService
Operation icons in the preview title	Disabled; the operations are done from the toolbar or from the right-click menu	Enabled
Original Rule in the preview	Built-in definition	The value the global layer applies
Restore to Default	The rule returns to its built-in value	The rule returns to the value of the global layer
Global custom rule	All its fields are edited with Edit Custom Rule and it is deleted with Delete	Only its state is changed for this vService with Change State
Recompile	The whole signature database of the device	The whole signature database of the device

• The rule set a vService actually works with is seen only on the OWASP Rules screen of that vService.
• The view settings (hidden columns, selected filters) are stored per user in a single place and are common to both screens.
• When WAF protection is turned off on a vService, the vService layer is not deleted; when the protection is turned on again, the same changes and custom rules become valid (If I remove WAF protection, are the learned rules and settings deleted?).
• The signature summary strip on the WAF Management tab is also calculated according to the protection level of the vService; its four boxes are the Signature Categories, OWASP Web Coverage, OWASP API Coverage and Status boxes (signature summary strip).

Common Misconceptions

• "The two screens are separate libraries." They are two layer views of the same library (What are the rule layers (built-in library, global layer, vService layer); which one takes precedence?).
• "A colorless row on the OWASP Rules screen has never been changed." Rules changed or added in the global layer appear colorless on this screen; to tell them apart, Signature & Rule Library is examined.
• "Which screen I am on can be told from its appearance." The two screens look exactly the same; the distinction is made from where the screen was opened and from the tab name (OWASP Rules).

How it is done in the documentation

• OWASP Rules · What Is OWASP Rules?
• OWASP Rules · The Counterpart of the Operations on This Screen
• OWASP Rules · Scope and Limits
• Signature & Rule Library · The Rule Layers

Related questions

• What are the rule layers (built-in library, global layer, vService layer); which one takes precedence?
• How do I fix the same false positive on several vServices at once (global layer)?
• If I remove WAF protection, are the learned rules and settings deleted?