Increase the WAF Paranoia Level

Increase the Paranoia Level to enable additional WAF rules and inspect traffic more strictly. Higher levels can also flag legitimate requests, so test the next level and tune false positives before using it to block traffic.

The portal runs this test through Staged WAF: the higher level evaluates real traffic in logging mode while the main WAF continues using its current level and enforcement mode. The CRS version stays the same during the test.

This guide takes you through testing the next level, reviewing its results, adding rule exclusions, and activating the higher level.

Test the next level

1. Open your HTTP Proxy under Traffic Management → Traffic Configurations.
2. Select Web Application Firewall → General.
3. Under Paranoia Level, click Upgrade to Paranoia Level N. The button offers the next level: for example, Level 2 when the main WAF uses Level 1.
4. Review the inherited rule exclusions and add any exclusions already needed for your application.
5. Click Create Staged WAF.
6. Back in the traffic configuration, click Apply, then Confirm to deploy the test.

The main WAF continues protecting traffic with its existing settings. Level 4 is the highest Paranoia Level; evaluate each increase before proceeding to the next. See How WAF works for background on the levels.

Only one upgrade can be tested at a time. If a CRS upgrade is already staged, complete that test or replace it before testing a higher level.

Deploy the test

Create Staged WAF prepares the change in the form. Complete Apply → Confirm to install it on the proxy. An Unsaved changes banner means deployment is still required.

Investigate false positives

Include representative application traffic, such as sign-in, forms, API requests, and uploads, in your evaluation. Test events appear in the dedicated staged view; the main WAF dashboards describe the active WAF.

Tune rules directly from the logs

You can investigate a triggered rule and apply an exclusion from Staged WAF View, without opening the traffic configuration's WAF form. This workflow is available for both Paranoia Level and CRS version tests.

1. In Web Application Firewall → General, click Analyze logs for Staged WAF. The Staged WAF View opens for your traffic configuration.

2. Open the time-range filter and select a period covering your test traffic, such as Last 7 days when the events occurred earlier in the week. If no events appear, also check the selected configuration, deployment status, and whether relevant traffic has occurred.

3. Find the rule in the Anomalies table and click WAF Tuning on its row. This opens Staged WAF Tuning for that rule, keeping the dashboard's time range and traffic configuration scope.

   

   Open WAF Tuning from the rule's row in the Anomalies table.

4. Review Rule Details, Triggered HTTP Proxies, and Paths to understand what matched. Source IPs, Cookie Names, User Agents, and Time of Day provide additional context.

5. Choose the appropriate exclusion using the controls in the tuning view:

   Scope	Where to apply it
   Global	Click Exclude globally on triggered HTTP Proxies under Rule Details.
   Path	In Paths, use the row action under Exclude rule by Path for the affected path.
   Cookie	In Cookie Names, use the row action under Exclude rule by Cookie Name for the affected cookie. Only cookies present in the rule trigger are listed, and exclusion must be supported by the rule and event data.

6. In Confirm Rule Exclusion, review the rule, scope, and affected proxy names. For a path exclusion, review or edit the path. Check that the dialog says it will update the Staged WAF, then click Exclude in the Staged WAF.

7. Check the result message. Use Go back to WAF view to return to the dashboard and review subsequent traffic to assess the change.

The tuning view applies the exclusion directly to the staged configuration; you do not need to open the WAF form or complete a separate Save changes → Apply step. The main WAF keeps its existing exclusions until you activate the upgrade.

Prefer a path or cookie exclusion when that is sufficient; a global exclusion disables the selected rule across the affected configuration. Check the affected proxy names before confirming an exclusion.

Add exclusions from the configuration

You can also add exclusions directly when you already know the rule and scope:

1. Click Configure Staged WAF, then select Rules.
2. Review inherited exclusions with Show exclusions currently in the main configuration. Current marks exclusions shared with the main WAF; Staged marks exclusions specific to the test.
3. Add the required exclusion:
   • Global: Click Add Rules, select rules, then click Add.
   • Per Path: Click Add Path, enter the resource path, and click Add. Expand the path to configure its excluded rules.
   • Inspection Target Exclusions → Per Cookie: Click Add Cookie, enter the cookie name, and configure its excluded rules.
4. Click Save changes, then Apply → Confirm in the traffic configuration to deploy the exclusions.
5. Return to the logs and evaluate subsequent traffic.

Use {*} for dynamic parts of a path or cookie name. An All rules exclusion is broader than excluding an individual rule. For more detail, see Handle false positives.

Saving exclusions

The WAF tuning view applies exclusions through its confirmation dialog. Edits in the configuration form require Save changes → Apply → Confirm.

Activate the higher level

Once representative traffic has been evaluated and false positives addressed:

1. Return to Web Application Firewall → General.
2. Click Configure Staged WAF to review the target level and exclusions, then return to General.
3. Click Apply to main WAF and review the confirmation.
4. Click Confirm, then Apply → Confirm to deploy the change.

The main WAF now uses the higher Paranoia Level and the tested rule exclusions, including path and cookie exclusions. Its CRS version and enforcement mode remain the same. If it is in blocking mode, the additional rules now enforce protection on live traffic. The separate test instance is removed.

Continue monitoring the main WAF after deployment. When you are ready for another increase, repeat this workflow for the next level.

To stop a test without activating it, see Remove a test. To evaluate newer detection rules at the same level, see Upgrade the WAF Core Rule Set version.