A false positive is a legitimate request that Filter or MLA blocked. Keep the exception as narrow as the settings allow, then send the same request again.
Open the attacks page in WMC. The record has the host, the path, the signature id and the blocking type. A signature match is written in the Filter log as CRL ID in a zone such as PATH, BODY, or HEADERS. A machine-learning block is blocking type 3 and is handled in How ML detection works, not by turning signatures off.
| Scope | Setting | What it stops |
|---|---|---|
| One signature in one zone of one host | A request processing rule with wl: true and wl_data naming the zone |
That signature match. Other signatures and other zones still apply |
| One URL | waf_url_wl |
Analysis of that URL |
| One IP address | waf_ip_wl |
Analysis of that address. The host in this option may be a name or an IP address. A port is not accepted |
| One host | waf_host_wl |
Analysis of the host, including signatures and MLA |
| One host, monitoring only | waf_host_dm |
Blocking for the host. The event is still recorded |
| API Firewall only | waf_openapi_url_wl, waf_openapi_ip_wl |
The API Firewall check for that URL or address |
| Anti-bot only | waf_antibot_url_wl, waf_antibot_ip_wl, waf_antibot_cc_wl |
Anti-bot mode for that URL, address, or country |
| Antivirus only | waf_av_url_wl, waf_av_ip_wl |
The antivirus check for that URL or address |
| Response signature | A response processing rule with wl: true |
A signature in the response. Request analysis stays on |
A request processing rule can also match ip, path, query, body, cookie, user-agent, other_headers and cc before it decides to block or to exclude. The fields are in Request processing rules. The WL and DM lists are in Managing settings of the Filter.
waf_host_wl is the widest of these. Use it only when the host must not be analyzed. A response exclusion does not turn off request analysis: Response processing rules.
Send the legitimate request again. The application answers and the attacks page has no new block for it.
Send the test signature on the same host:
curl -i https://example.com/mikiri-waf-test
Filter answers 403 unless the host is in waf_host_dm or a rule excludes the PATH zone. A missing 403 is diagnosed in A test request is not blocked.