Can I apply different WAF rules to different domains behind the same vService?

Short answer

Yes. The WAF rules, that is, the page types (Page Types) and the field inspections inside them, are kept per host group. A Virtual Host Group is added for each domain name or for the domain names to be protected together; the page type list of that group is learned separately and edited separately, and the group works with its own WAF Mode value. What can be separated per group is the page types and the Any Paths rule, the OWASP Check and OWASP Exclusions settings in the fields, the WAF Mode and the Analysis & Learning results. OWASP Protection Level (the blocking threshold), the status and score of the signatures, Checks, Whitelist & Blacklist, Blocking Page, Request Body Limits, Learning Methods, and the log, report and notification settings are vService-wide. Rules are not copied between the groups; Export is done on the Page Types screen of the source group, and Import on that of the target group. If a different protection level is needed per domain name, the domain name is moved to a separate vService that is opened on the same IP:Port with Virtual Hosting.

How Does It Work?

The request falls into a host group according to its Host header (Which host group does a request fall into; what if it matches none?); path matching is done only in the page type list of that group (runtime rule matching). For this reason, even though shop.example.com and api.example.com are published from the same vService, each of them is inspected with its own rules.

Separated per host group	Common across the vService
Page types and field inspections (WAF Rules)	OWASP Protection Level (Can I set the protection level separately for each domain / host group?)
The group's Any Paths rule	The status and score of the signatures (OWASP Rules)
OWASP Check and OWASP Exclusions in the fields	Checks, Whitelist & Blacklist, Blocking Page, Request Body Limits
WAF Mode	Learning Methods (Teacher, Conditional Learning, AI Learning)
Analysis & Learning results	Log, report, notification and SIEM settings

If a signature needs to be turned off on only one domain name, the OWASP Exclusions list of the field in the page type of that group is used, not the status of the signature (Can I turn off OWASP scanning for a specific parameter?).

Setup in TR7

1. Add the group: In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the group is added with the icon at the top right of the Virtual Host Groups band at the very bottom: Virtual Host Group Name, WAF Mode (Learning Mode is recommended for a new domain name) and Virtual Host Patterns are entered and Add is clicked (How is a Host Group added; what goes into the Virtual Host Patterns field?).
2. Create the rules: The N page types row on the mode card of the group opens the Page Types tab of the group; the rules are learned from the traffic (Analysis & Learning on the card), added manually with Add or loaded from a file with Import.
3. To start with the rules of another group: An Export is taken on the Page Types screen of the source group, and Import is done on the Page Types screen of the new group; Import replaces the rule set of the target group entirely (Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?).
4. Advance the mode: The new group is moved from Learning to Monitor, then to Blocking; the mode of the other groups is not affected (Can I use different modes for different domains on the same vService?).

The changes are applied the moment they are saved. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

Common Misconceptions

• "A different protection level can also be selected for a different domain name." OWASP Protection Level is vService-wide; for a different threshold, the domain name is moved to a separate vService that shares the same IP:Port through Virtual Hosting.
• "A new group uses the rules of the other group." Every group carries its own list; a new group starts with the default rule set and the suggested header inspections, and copying is done with Export and Import.
• "Setting a signature to the Monitor state on one domain name affects only that group." The signature status is vService-wide; an exclusion specific to one domain name is made with OWASP Exclusions in the field of the page type.

How it is done in the documentation

• Virtual Host Groups · What Is Virtual Host Groups?
• WAF Rules · Page Types
• WAF Rules · Import

Related questions

• Can I set the protection level separately for each domain / host group?
• Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?
• Can I use different modes for different domains on the same vService?