Monitor Mode
About
As long as the TR7 WAF is in Monitor Mode, the rules taught to the system and the logs are followed. In monitor mode, requests are not blocked, but their logs can be viewed in WAF Logs on the TR7 ASP web interface. This mode is "What would happen if we put it in Blocking mode?" It was designed as an answer to the question. It is put into Blocking Mode by waiting in this mode until the level of false-positive decreases to a minimum in the vService.
TR7 ASP Web GUI
How To Activate The Monitor Mode For A vService On TR7 ASP WAF?
To put WAF in Monitor Mode on the desired vService with WAF enabled on TR7 ASP device;
Method > 1
"Setting Mode > vServices" steps are followed. Click on the desired vService and then click on the Monitor icon on the screen that opens on the right.
Click on the WAF Management tab located in the upper tabs on the incoming screen.
Click on the Edit icon next to the desired Host Group whose WAF Mode will be changed.
"Monitor Mode" is selected as the WAF Mode and the Edit button is clicked. The vService is expected to restart.
Method > 2
"Setting Mode > WAF Services" steps are followed. Right click on the desired vService and select "Edit" or click on the relevant vService and select "Actions > Edit" from the window that opens on the right to reach the same window.
"Monitor Mode" is selected as the Working Mode and the Edit button is clicked by scrolling down to the bottom of the page. Wait for the vService to restart.
Method > 3
Switch to Monitor Mode on the TR7 ASP device web interface and click on the desired vService.
Click on the WAF Management tab located in the upper tabs on the incoming screen.
Click on the Edit icon next to the desired Host Group whose WAF Mode will be changed.
"Monitor Mode" is selected as the WAF Mode and the Edit button is clicked. The vService is expected to restart.