If my custom rule fails to compile, does the WAF keep protecting; how do I find out?

Short answer

Yes, the protection continues. The rule that cannot be compiled is not applied; the other rules continue to work (State Values and Their Counterpart in the Traffic). This situation appears on the library screen in three ways: the row of the rule is painted in a red tone and the (Faulty) suffix is added next to the state in the State column (on hover, This rule failed to compile and is currently NOT being enforced. Fix or remove its pattern.); the N rules compiled, M failed band appears above the list; the Faulty option in the State group of the Filter window filters these rules. If the compilation process cannot run at all, a red warning band appears above the list and the WAF rule compilation alarm is produced; in this case the protection continues with the rule set that was compiled successfully last. Since a pattern is validated by being compiled on the device while it is added and edited, a pattern that cannot be compiled cannot be saved; for this reason the situation is rare. To fix it, the pattern of the rule is corrected with Edit or the rule is deleted; if needed, Recompile is run afterwards.

How Do I Find Out?

Situation	Display
One or a few rules could not be compiled	The row has a red tone; the State column in red text, e.g. Enabled (Faulty); the N rules compiled, M failed band above the list; Filter → State → Faulty
The compilation process could not run at all	Red band above the list: WAF rules cannot be compiled right now — protection keeps running on the last successfully compiled rule set. Please report this to TR7 support.; WAF Rule Compilation alarm: WAF security rules could not be compiled. Protection keeps running on the last successfully compiled rule set. Please report this to TR7 support. When the problem is resolved, the alarm closes as WAF rule compilation recovered
The vService could not load the compiled rule database	The WAF rules are not loaded, traffic is not being inspected: … warning in the vService status; the cause is written at the end of the message (e.g. the compiled rule database was built for a different processor type and has to be recompiled on this machine). In this case Recompile is run (What is Recompile and when is it needed?)

• The band and the Faulty marks on the library screen are counted according to the scope of the screen: Signature & Rule Library covers the built-in and global rules, and the vService's OWASP Rules screen covers, in addition to these, the rules specific to that vService.
• In the Filter → State group, a rule that cannot be compiled is counted only under Faulty; on the State card, on the other hand, it is counted under its own state (e.g. Active).
• The channels the alarms are delivered through: What are the notification channels (UI, e-mail, SMS, SNMP)?
• The compilation validation during saving: Which regex syntax is supported in custom rules (backreference, lookaround); can I test a rule before saving it?

Common Misconceptions

• "If a rule cannot be compiled, the WAF stops." Only that rule is not applied; the other rules work. Even if the compilation process cannot run at all, the last successful rule set continues to be used.
• "A Faulty rule is the same as Disabled." The state of a Faulty rule may appear as Enabled, but the rule is not being applied; its pattern is fixed or the rule is deleted.
• "Recompile fixes a broken pattern." Recompile does not change the pattern; the pattern is fixed first.

How it is done in the documentation

• Signature & Rule Library · State Values and Their Counterpart in the Traffic
• Signature & Rule Library · Recompiling of the Signature Database
• Signature & Rule Library · Filter

Related questions

• I see rule 369999 in Debug Mode Logs or SIEM records; what is it?
• What is Recompile and when is it needed?
• What are the notification channels (UI, e-mail, SMS, SNMP)?