WAF learning sessions

How a session works

1. Put in the addresses your testers will come from. An office, a VPN, a build runner, somebody's laptop. More than one is normal.
2. Name the round, such as "checkout regression, August release".
3. Press Start watching.
4. Exercise the application properly. Click everything. Upload something. Use the search. Post a comment with an apostrophe in it.
5. Press Stop watching.
6. Look at what fired, tick the ones that are your application rather than an attack, and save them as a profile.

Why it asks for addresses first

Because the internet does not stop while you test. A learning session with no address filter would collect every scanner, every bot and every genuine probe that arrived during the window, and you would end up excusing rules on the strength of somebody else's attack.

The address list is what separates your testing from whoever else turns up, so it is asked for first and it cannot be left empty.

What an exclusion actually is

Each one stops a specific rule firing on a specific path where it was wrong about your application. It is narrow on purpose.

The rules still decide what gets refused everywhere else, and anything they do not recognize is still allowed. An exclusion is not a hole in the WAF, it is a correction to a rule that misunderstood one page.

The star in a path

Paths that hold an id are collapsed to a star automatically, so /user/*/profile covers the account created tomorrow as well as the one you tested with.

Rounds are kept

Nothing is thrown away when you stop watching. You can come back to an earlier round and save a profile from it later, and a walk through the application done over two afternoons still adds up to one profile, because saving adds to what is there rather than replacing it.

Learning the allowed surface

The same session also records which paths your testers actually reached. That list is what the allowed surface setting uses. Only what a tester reached can be ticked, for the same reason as the exclusions: a surface built from guesses is a surface that refuses real visitors.

A realistic rollout

1. Install the rules from Settings and confirm every node has them.
2. Turn the WAF on for one site in watching mode. Leave it a week.
3. Run a learning session against a proper test pass.
4. Save a profile, apply it, and stay in watching mode for another few days.
5. Check the hit list again. It should be nearly empty for your own traffic.
6. Move to blocking known malicious. Watch for a week.
7. Only then consider full enforcement, and raise the strictness one step at a time.

That is slower than the marketing version and it is the version that ends with a WAF still switched on six months later.

Common questions