Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How does the protection level affect what the OWASP Rules screen shows?
Short answer
The vService's OWASP Rules screen knows the vService's OWASP Protection Level setting. If the level is not Aggressive, Low-score signatures are not scanned on that vService, because on their own they cannot reach any threshold; the screen subtracts these signatures from the counts and marks them with an asterisk. The asterisk appears next to the Total Active Signatures value at the top (on hover, N signatures do not fire at this protection level), in the Active row on the State card and in the Score column of the affected rows as Low*. At the default Very Tight level, 135 Low rules (463 signatures) in the built-in library are subtracted. The signature summary strip on the WAF Management tab also shows the same subtracted numbers. On the device-wide Signature & Rule Library screen, since there is no level context, the asterisk does not appear and Low signatures are counted as well. For a Low signature to work on this vService, instead of changing the level, the score of the signature can be raised to Medium or above.
How Does It Work?
| Protection level | Threshold | Low signatures | On the OWASP Rules screen |
|---|---|---|---|
| Elementary | 24 | Not scanned | Low rows Low*, subtracted from the counts |
| Normal | 16 | Not scanned | Low rows Low*, subtracted from the counts |
| Tight | 8 | Not scanned | Low rows Low*, subtracted from the counts |
| Very tight (default) | 4 | Not scanned | Low rows Low*, subtracted from the counts |
| Aggressive | 2 | Scanned; a single hit reaches the threshold | No asterisk, full counts |
The values the screen shows at the default Very Tight level when there is no custom rule:
| Value | Signature & Rule Library | The vService's OWASP Rules screen |
|---|---|---|
| Total Active Signatures | 10,370 | 9,907* |
| Unique Signature Patterns | 3,347 | 3,212 |
| Signature Categories | 36 | 35 (both of the two rules in Cache Poisoning are Low) |
| Place | Display |
|---|---|
| Asterisk next to Total Active Signatures | On hover, N signatures do not fire at this protection level; N is the number of subtracted rules |
| State card → Active row | With an asterisk; the same explanation note below the card |
Score column → Low* | The score text is pale; on hover, Low-score rule — inactive at this protection level. It only fires when the level is set to Aggressive. |
| WAF Management → signature summary strip | The same subtracted numbers; an asterisk next to Total Active Signatures |
- The state of an asterisked signature does not change: it continues to appear in the list as Enabled (or its own state); it is only not scanned at this level. It is not scanned in Learning mode either.
- Level and thresholds: What is the OWASP Protection Level; how many levels are there? · the effect of changing the level: How does tightening the protection level affect false positives?
- Two ways of bringing a Low signature back: raising the score of the signature to Medium or above only for this vService (Can I change a signature's score (Low / Medium / High / Very High)?) or setting the protection level of the vService to Aggressive; the second causes all the signatures to block with a single hit.
Common Misconceptions
- "An asterisked signature is Disabled." Its state does not change; it is only not scanned at this level. It works when the level is set to Aggressive or when its score is raised to Medium or above.
- "If there is no asterisk on the global screen, Low signatures are working on every vService." The global screen does not know the protection level; the actual situation on a vService is seen on the OWASP Rules screen of that vService.
- "The Total Active Signatures asterisk counts signatures." The N in the explanation is the number of subtracted rules (rows); the number of subtracted signatures is read from the difference between the Total Active Signatures values on the two screens.
How it is done in the documentation
