What is the default host group?

Short answer

The default host group is the catch-all group that is created automatically on every vService when WAF is turned on and that cannot be deleted (Virtual Host Groups). It has no host pattern; the requests that match the pattern of none of the named groups fall into it. Requests that have no Host header also fall into it if no group's pattern matches the target IP:port value. On the mode cards, its name always appears as Default Host Group in italics; in the group list (italic row), in the Virtual Host Groups field of the analysis window and in the Host Group information of the Event Logs record, on the other hand, it appears with its saved name (DEFAULT_HOST_GROUP if it has not been changed). When WAF is turned on, it takes the WAF mode of the vService (default Learning) (after it is enabled); after that, its mode changes only with the Edit on its own mode card. The edit window has only the Virtual Host Group Name and WAF Mode fields; there is no Virtual Host Patterns field. It carries its own page type list and its own Any Paths rule. While there is no other group on the vService, all the traffic is inspected in the mode and with the rules of this group.

How Does It Work?

Property	Default group
Creation	Automatic when WAF is turned on; it is recreated on its own and cannot be deleted (Can the default host group be deleted?)
Requests it handles	Requests that do not match the patterns of the named groups; requests that have no Host header and for which no group's pattern matches the target IP:port value (Which host group does a request without a Host Header fall into?)
Displayed name	Default Host Group on the mode card (even if the name is changed); its saved name in the group list (italic row), in the analysis window and in Event Logs
Starting mode	The mode of the vService when WAF is turned on: default Learning
Editable fields	Virtual Host Group Name and WAF Mode
Rules	Its own page type list and Any Paths rule; when WAF is turned on, the built-in default rule set is written to this group
Mode card	At the very end of the mode cards while there is more than one group; the card body reads Requests matching no other group's hosts are handled here. While there is a single group, the card shows only the mode, without the group name and this sentence (host group mode cards)

For a request that falls into the default group, path matching is done with the group's own page types; a request that matches no page type is inspected with the group's Any Paths rule (How is a request that matches no page type inspected?).

Managing the Default Group in TR7

• Changing its mode: In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, Edit in the bottom right corner of the title strip on the mode card of the default group is clicked, WAF Mode is selected and Edit in the window is clicked (WAF Mode Edit screen). The WAF Mode value at the vService level determines only the starting mode of new groups; it does not change the mode of the existing groups.
• Accessing its rules: The N page types row under the mode card opens the Page Types tab of the group.
• Narrowing its role: When all the expected domain names are moved to named groups, the default group handles only unexpected Host values (e.g. requests made directly by IP, undefined subdomains). If this group is kept in Monitor or Blocking mode, the attacks in these requests are also written to Event Logs; in Blocking mode, they are blocked.
• In the records: In the Host Group information of the WAF Event Logs record, the requests that fall into the default group appear with the name of this group.

Common Misconceptions

• "Changing the WAF Mode value of the vService changes the mode of the default group." The mode is saved in the group; the mode of the default group is changed from its own mode card.
• "A pattern can be added to the default group." The edit window of the default group has no Virtual Host Patterns field; for a specific domain name, a named group is added.
• "A request that matches no group passes without being inspected." It is inspected in the mode and with the rules of the default group.

How it is done in the documentation

• Virtual Host Groups · What Is Virtual Host Groups?
• How to Enable WAF? · What Is Created After It Is Enabled?
• WAF Mode · Virtual Host Patterns

Related questions

• Can the default host group be deleted?
• What is the Any Paths rule?
• How is a request that matches no page type inspected?