Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
If I change a built-in signature's score, state or scan scopes, how do I see the original (Original Rule / Edited Rule)?
Short answer
The built-in signature itself never changes; the Edit Rule Changes form or the Change State window writes a change record on top of the signature, and the original value can always be seen. A rule that has been changed in the layer of the current screen is written in italic in the list and painted in a yellow tone; when the row is clicked, the preview splits into two columns: Original Rule on the left, Edited Rule on the right; the fields that differ (State, Score, Active Signature Fields) are highlighted, and the ones that stay the same are shown in a single cell. Also in the Edit Rule Changes form opened with Edit, the switch of the fields changed in this layer comes in the Change position, and that of the others in the Keep Original position. On the Signature & Rule Library screen, Original Rule is the built-in definition; on the vService's OWASP Rules screen, on the other hand, it is the value the global layer applies, and to see the built-in value, the same rule is examined in Signature & Rule Library. To remove the change, Restore to Default is used.
Problem: The Original of the Changed Signature Is Unknown
The score, state or scan scopes of a signature have been changed; there is a need to see what the built-in value is and which fields have been changed in which layer.
Solution: Three Methods
| Your situation | Suitable method |
|---|---|
| Seeing the original and the edited values side by side | Method 1: Preview comparison |
| Seeing on the form which fields have been changed, or editing them | Method 2: Edit Rule Changes form |
| I am on the vService screen; I want to see the built-in value | Method 3: The same rule in Signature & Rule Library |
Method 1: Preview Comparison Recommended
- How it works The preview of a rule changed in this layer opens with two columns; the Signature and Classification tabs carry the same two headings.
- Where it is opened Signature & Rule Library or the vService's OWASP Rules screen → changed row
- Requirement View permission in the WAF area
- Scope The layer of the current screen
Step-by-Step Configuration
1
Adım 1 Find the changed rule
The rows changed in this layer are italic and yellow-toned. Rules whose score or scope has been changed are filtered with Filter → Customizations → Changed; rules whose state alone has been changed do not fall into this option and are recognized from the appearance of the row.
2
Adım 2 Open the preview
The row is clicked; the Original Rule and Edited Rule columns appear in the preview on the right. The changed fields are shown separately and highlighted in the two columns; the fields that do not change, such as ID, Type, Name, Description and the classification, are in a single cell.
Verification
1PreviewTR7 side
The column headings of the preview are examined.
Expected
Original rule · Edited ruleMethod 2: Edit Rule Changes Form
- How it works In the form, each field comes with a Keep Original / Change switch; the position of the switch shows whether the field has been changed in this layer.
- Where it is opened Signature & Rule Library or the vService's OWASP Rules screen → rule → Edit
- Requirement Write permission in this layer
- Scope The layer of the current screen
Step-by-Step Configuration
1
Adım 1 Select the rule
The row of the rule is checked; Edit is enabled only while a single row is selected.
2
Adım 2 Open the form
Edit on the toolbar is clicked. In the Edit Rule Changes window, the switch of the fields changed in this layer (State, Score, Inspection Scopes) comes in the Change position and their selection list comes with the changed value. The selection list of the fields in the Keep Original position is not shown; if the switch is set to the Change position, the list opens with the value that comes from the upper layer.
3
Adım 3 Close or save
If the form is only to be examined, the window is closed without saving. If a change has been made, Accept is clicked; if all three switches are set to Keep Original at once and saved, the change record is deleted.
Verification
1FormTR7 side
The positions of the switches are examined.
Expected
Fields in the Change position = fields changed in this layerMethod 3: The Same Rule in Signature & Rule Library
- How it worksOriginal Rule on the vService screen is the value of the global layer; the built-in value is seen on the device-wide screen.
- Where it is opened Configuration Menu → WAF → Signature & Rule Library
- Requirement WAF license; view permission in the WAF area
- Scope Device-wide
Step-by-Step Configuration
1
Adım 1 Open the library screen
The Configuration Menu is opened with the TR7 logo at the bottom left and WAF → Signature & Rule Library is clicked (how to access).
2
Adım 2 Find the same rule
The ID of the rule is written in the Search field.
3
Adım 3 Look at the preview
The row is clicked. If the rule has been changed in the global layer, the preview has two columns and Original Rule is the built-in definition; a single-column preview indicates that the rule has not been changed in the global layer and that the values shown are the built-in values. Layer logic: What are the rule layers (built-in library, global layer, vService layer); which one takes precedence?
Verification
1PreviewTR7 side
The Original Rule column in the Signature & Rule Library preview (the single column if the preview has a single column) is examined.
Expected
Built-in State, Score and Active Signature FieldsCommon Mistakes
- Taking Original Rule on the vService screen for the built-in value. There, Original Rule is the value the global layer applies.
- Looking for a rule whose state alone has been changed under the Changed option. A state-only change does not enter the Customizations → Changed count; the row appears italic and yellow-toned.
- Looking for the pattern of a built-in signature in the preview. The name, description and classification of built-in signatures are visible, but their pattern is not shown in the interface; the name, description, pattern and classification cannot be changed, only the state, score and scopes are changed.
How it is done in the documentation
