An attack attempt was not blocked; why?

Short answer

First, how the request was classified in the WAF is found: WAF Inspection Distribution on the Dashboard counts the request as Whitelisted, Learning, Teacher, Monitor, Blocked or Clean; Security Action in the Debug Mode Logs record also shows the decision for a single request. The most common causes: the host group that the request fell into is in Learning Mode or Monitor Mode (a request whose Host header matches no group falls into the default group); the test request carries the Teacher or Conditional Learning identity, or matches Whitelist Condition; the total score does not reach the OWASP Protection Level threshold (in Normal and Elementary, a single signature is not enough to block); the effective state of the signature on this vService is Monitor or Disabled (the state may have been changed on the OWASP Rules screen of the vService or in the device-wide Signature & Rule Library); in the page type that the request matched, OWASP Exclusions have been learned for that field or OWASP Check is off; when the body exceeds the Max. Body Size to Process(kB) limit, the body passes in the Any Paths rule without being scanned at all. If a code such as 200 is selected as Blocking Status Code, a blocked request also looks "as if it passed".

Problem: The Test Attack Was Not Blocked

In a security test or in a real incident, a request containing an attack reached the Backend Service, or the response was not the blocking page. It is not known whether the WAF did not inspect the request at all, inspected it and chose not to block it, or did not recognize the attack at all.

Possible Causes

Cause	How to tell it apart	Solution
The host group is in Learning Mode (signature hits are not added to the score, no blocking decision is made)	On the mode card, "Learning mode — rules are not enforced yet"; the request is in the Learning series; no WAF record in Debug Mode Logs	When should I move from Learning to Monitor and from Monitor to Blocking?
The host group is in Monitor Mode (recorded, not blocked)	On the mode card, "Attacks are only monitored, not blocked"; the Event Logs decision is "Not blocked — Monitor mode"	Same page
The request fell into another host group (different Host header, access by IP address, or no header)	Host group on the Request & Location tab of the Event Logs record; the mode card of that group	Which host group does a request fall into; what if it matches none?
The test source is recognized as Teacher (not blocked whatever its score)	A request whose score reaches the threshold is recorded in Event Logs with the "Not blocked — Teacher … matched" decision (Teacher IP, Teacher cookie or Teacher header) and counted in the Teacher series; on the Learning Methods card, "Teacher is on — teaching sources are identified by …"	What is Teacher; which sources can I define as Teacher (IP, header, cookie)?
The test source carries the Conditional Learning identity (written to the learning log even in a group in Blocking mode)	On the Learning methods card, "Conditional learning is on — the analyst is recognised by …"; the request is in the Learning series	Can I still keep learning certain traffic while in Blocking mode (Conditional Learning)?
The request never entered the WAF (Whitelist Condition, static content or, on a vService with AGS on, a request that starts with AGS Root Path)	The request is in the Whitelisted series; on the Whitelist & Blacklist card, "Requests matching this condition skips WAF inspection:" or "Static content bypasses WAF inspection"; for AGS Root Path, there is no row on the card	Can I exempt certain IPs or requests from WAF inspection entirely (Whitelist Condition)? · What is the order when WAF and AGS are used together?
The total score is below the OWASP Protection Level threshold	The request is in the Clean series; if no signature in Monitor state was triggered, there is no record in Event Logs	Which protection level should I choose (Elementary, Normal, Tight, Very Tight and Aggressive)?
The signature is in Monitor or Disabled state	The State value of the signature on the OWASP Rules screen of the vService; at levels other than Aggressive, the Score value of a Low-score signature is shown with an asterisk (Low*) and with the "Low-score rule — inactive at this protection level…" hint	What does a signature's state (Enabled / Monitor / Disabled) mean?
OWASP Exclusions have been learned for that field or OWASP Check is off	The rule in the Matching Path Rules value of the record; OWASP check and OWASP exclusions on the relevant tab of the rule	Can I turn off OWASP scanning for a specific parameter? · Can I revert a learned rule?
The number of OWASP exclusions in a field exceeded the Max. OWASP Exclusions limit	The OWASP exclusions list of the field is longer than the limit (default 25)	What does the "Max. Owasp Exclusions" setting do; what happens if the limit is exceeded?
The body did not fit in the buffer and the matching rule allows a body that cannot be parsed	The request body is larger than the Max. Body Size to Process(kB) limit (default 4096); no record	What happens to request bodies that exceed the Max. Body Size to Process(kB) limit or do not complete in time?
There was a block, but Blocking Status Code is a code such as 200	The response body is the blocking page; the Event Logs decision is "Attack blocked"	Why is the 418 status code returned by default on a block; can I change it?
The attack has no signature	There is no match that exceeds the threshold; no record	Can TR7 WAF catch a zero-day attack without a signature?
The signature database could not be loaded	The "WAF rules are not loaded, traffic is not being inspected: …" warning in the status messages of the vService preview	How do I download the encrypted diagnostic bundle for the support team (Encrypted Support Bundle)?
The request never reached the WAF-protected vService	No request on the HTTP Logs screen of the vService	DNS and the VIP address are verified

Definitive rules:

• A request is blocked only when its total score reaches the OWASP Protection Level threshold. Thresholds: Aggressive 2, Very tight 4 (default), Tight 8, Normal 16, Elementary 24. Signature scores are Low 2, Medium 4, High 6, Very High 8; in Normal and Elementary, a single signature does not reach the threshold, and in Tight, only a signature with a Very High score reaches it on its own. Low-score signatures do not run at all at levels other than Aggressive (Blocking threshold).
• A signature in Monitor state is not added to the score; when it is triggered in a request that does not reach the threshold in a group in Blocking mode, the request is recorded with the "Not blocked — Below the blocking threshold" decision (In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?).
• A request recognized by Teacher is not blocked whatever its score; if its score reaches the threshold, it is recorded, according to the identity that recognized it, with the "Not blocked — Teacher IP matched", "Not blocked — Teacher cookie matched" or "Not blocked — Teacher header matched" decision. In a group in Learning mode, signature hits are not added to the score and no blocking decision is made; in a request that arrives with the Conditional learning identity, no score is accumulated.
• In Blocking mode, a request whose scan cannot be completed within the 2-second time limit is also blocked (if Fail-open in the Request Body Limits window is on, it is passed without being scanned); this block is not written to Event Logs (Why does a request that received 418 not appear in Event Logs?). Requests recognized by Teacher and requests that arrive with the Conditional learning identity are not blocked in this case either.
• Do not WAF static contents is on by default: GET requests that have a common static file extension and carry no query and no body do not enter the WAF. If the attack payload is carried in the query or the body, the request is not treated as static (Which requests are treated as "static content" and excluded from WAF inspection (extension, method, query and body conditions); is this safe?).
• Even if the Conditional learning switch is turned off, matching continues as long as the identity fields (IP, header, cookie) are filled; the test source is deleted from the fields while the switch is on, and the change is saved (while the switch is off, changes in the fields are not saved). For Teacher, turning off the switch is enough.
• If the OWASP exclusions list of a field is longer than the Max. OWASP Exclusions value, signature scanning is turned off in that field.
• In the Any Paths rule, the unparsed body option on the Raw tab allows by default: if the body does not fit in the buffer or is not completed within the Wait for body for a time duration, the body is not scanned; the path, query and headers are still scanned. When the option is changed to blocking, such a request is caught by the Block Unparsed Contents rule (What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?).
• In Debug Mode Logs, a request has a WAF record only if it was written to Event Logs (threshold exceeded or a signature in Monitor state) or was blocked at the scan time limit. There is no WAF record for requests in Learning mode and requests with the Conditional learning identity, for exempted requests, or for requests that stay below the threshold and do not trigger a signature in Monitor state.

How to Diagnose?

1. Before starting the test, in the edit form of the vService on the Load Balancer → Load Balancer vService List screen, Status = Debug mode is selected and Save is clicked. Under heavy traffic, the recording is narrowed to the IP of the test source with the condition field under Debug (conditional debug). Turning on Debug mode requires modify permission in the Load Balancer area, and viewing Debug Mode Logs requires monitoring permission in the Load Balancer area; for a user who has only WAF permission, these screens do not open (Logs & Tracking).
2. The test request is sent; Left Monitor Panel → Load Balancer vServices → vService → Logs & Tracking → Debug Mode Logs is opened and the Security Action column, which is hidden by default, is added from the Columns menu. When the row is clicked, Verdict, Attacks and Triggered rules are read in the WAF box on the Summary tab.
3. If there is no WAF box, the request is a request in Learning mode or with the Conditional learning identity, an exempted request, or a request that stayed below the threshold and did not trigger a signature in Monitor state. Which of these it is is read from the series at the time of the test in the WAF Inspection Distribution panel on the Dashboard tab of the vService: Learning, Whitelisted or Clean (What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?).
4. If Verdict is "Not blocked — Monitor mode" or "Not blocked — Teacher … matched" (Teacher IP, Teacher cookie or Teacher header), the mode card of the group and the Learning Methods card are read on the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management screen.
5. If the record went to Event Logs, the Host group and Matching path rules values on the Request & Location tab of the record and the triggered signatures on the Attacks tab are read. If the decision is "Attack blocked" but the test tool did not see the block, the status code in the "A blocked client gets … with status …" sentence on the Blocking Page card in WAF Management is read.
6. If it is in the Clean series, the level on the OWASP Protection Level card in WAF Management and the State and Score values of the tested signature on the OWASP Rules screen are examined. If the signature state is Enabled and its score is sufficient, the OWASP check and OWASP exclusions settings of the relevant field in the page type that the request matched are examined (Inheritance and Rule Source).
7. When the examination is finished, Status is set back to Enabled and saved (What does Debug Mode record; how long should I keep it on?).

Common Mistakes

• Running the test on a host group in Learning mode. In Learning mode, signature hits are not added to the score and no blocking decision is made; a blocking test is run on a group in Blocking mode. In Monitor mode, the request is not blocked, but a request that exceeds the threshold is written to Event Logs with the "Not blocked — Monitor mode" decision.
• Forgetting that the test source carries the Teacher or Conditional learning identity. The IP of the test team, or the TR7-LEARN / TR7-ANALYZE header and cookie in its browser, keeps the request out of blocking.
• Looking for hits below the threshold in Event Logs. If no signature in Monitor state was triggered, matches below the threshold are not recorded; the request being counted in the Clean series shows this situation.
• Testing with the IP address. A request whose Host header is an IP address instead of a domain name falls into the default group, not into the group defined for the domain name, and the mode of that group is applied.
• Thinking that the test "passed" while Blocking status code is 200. The response body contains the blocking page; whether the request reached the Backend Service is verified from HTTP logs.
• Leaving Debug mode on. Debug mode records every request in detail; when the examination is finished, Status is set back to Enabled.

How it is done in the documentation

• WAF · The Three Situations That Do Not Enter the Score
• WAF · The Blocking Threshold
• Dashboard · WAF Inspection Distribution
• OWASP Protection Level
• WAF Mode · Runtime Behavior of the Modes

Related questions

• In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?
• How does TR7 WAF decide whether to block a request?
• What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?
• Can TR7 WAF catch a zero-day attack without a signature?