Audit only WAF options

Rule Audit options after migration from legacy WAF to current WAF

Product: LoadMaster

Version: 7.2.54 and later

Platform: Any

Application: Any

After migrating from legacy WAF to the current WAF, is it possible to put the current WAF in audit only mode in order to assess if there will be any impact to our applications?

• The current version of WAF does not include an audit only option, but a delay can be configured for how many times a rule is triggered before it is blocked.

• For example, on the current version of WAF, increase the Anomaly Scoring Threshold to a very high value. With the Anomaly score, for each request every triggered detection raises the anomaly score, most rules having a score of 5. If the cumulative anomaly score per request hits the configured limit, the request will be blocked. The default value is 100 and allowable range is 1 to 10000. Setting this to a very high value will prevent any requests which match on a rule from being blocked.

https://support.kemptechnologies.com/hc/en-us/articles/203128369-Web-Application-Firewall-WAF-#MadCap_TOC_10_2