ronutz

AWAF signature accuracy/risk interpreter

Read an attack signature's published Accuracy and Risk and it tells you how false-positive-prone it is, how damaging a real match would be, and the tuning move. F5 defines accuracy as false-positive susceptibility, so low accuracy means many false positives. Runs entirely in your browser.

Documentation (Markdown)

Security & WAF

The signature's published properties

Computed in your browser. Nothing is sent.

A deterministic model of F5's documented signature properties, not a per-ID database. Read Accuracy, Risk, and Systems from the signature's own entry under Security > Options > Application Security > Attack Signatures. It never contacts a BIG-IP.

False-positive-prone, low stakes

High false-positive likelihoodLow damage if realBlocking now

The tuning move

This is the prime relax candidate. Low accuracy means frequent false positives and low risk means little is lost if you relax it, so disabling it on the specific URL or parameter (or leaving it in staging) is reasonable once you have confirmed a false positive.

What this means

  • F5 defines accuracy as a signature's susceptibility to false positives, and a Low accuracy signature has a high likelihood of false positives.
  • Confirm whether this signature's system applies to your stack; a signature for a system you do not run only generates false positives.
  • If low-accuracy false positives are frequent, let accuracy guide which signatures you enforce. Accuracy is a documented signature property and a signature-set filter criterion, so a signature set weighted toward higher-accuracy signatures produces fewer false positives, because F5 defines accuracy as false-positive susceptibility.
  • Scope any change to the specific URL or parameter, or filter the signature set. Disabling a signature policy-wide trades one false positive for a blind spot everywhere else.
API endpointGEThttps://ronutz.com/api/v1/f5-awaf-signature-accuracy-riskDocumented, not served. Opens the specification.

References