WAF scoring and paranoia levels
A matching scoring rule adds its score once per transaction. Request metadata and body share a transaction; WebSocket messages and responses have separate transactions. Challenge actions add no score. Several rules can score the same request, including rules from different rulesets. The scoring mode determines whether eligible scores combine across rulesets or each ruleset must reach its own threshold.
Choose a scoring mode
Each WAF policy sets its own Scoring mode under Firewall → WAF policies, or through the policy API's ScoringMode field. New policies use Combined. Apply the staged configuration to Edge after saving.
| Mode | Blocking decision | Use it when |
|---|---|---|
| Combined | Add blocking scores from all applicable rulesets and compare the sum with the policy threshold. | Evidence spread across rulesets should contribute to one decision. |
| Per ruleset | Compare each ruleset's blocking score with its own threshold; any one reaching its threshold can block. | Each ruleset should reach a decision independently. |
Set Blocking threshold in the policy editor, the policy API's Threshold, or the Docker label clearplane.proxy.waf.threshold. It defaults to 5. Higher thresholds require more score before blocking.
In Per ruleset mode, set an individual threshold in the policy's ruleset overrides editor or with ThresholdOverride in that ruleset's RulesetOverrides API entry. The combined threshold and Docker threshold label do not replace these individual thresholds. Profiles select rules and inspection limits, not thresholds.
For example, two rulesets each contribute a blocking score of 3. Combined mode blocks at a threshold of 5. Per ruleset mode with both thresholds at 5 does not block, because neither ruleset reaches its threshold.
Blocking and detection scores
Blocking score contains matches eligible to block: the route's WAF policy is in Prevention, the ruleset is in Prevention, and the rule is within the policy's paranoia level. Detection score contains scored matches outside those conditions. Detection scores never help a Prevention ruleset cross a blocking threshold.
A Prevention ruleset scoring 3 and a Detection ruleset scoring 3 therefore produce a blocking score of 3 and detection score of 3. They do not block at a threshold of 5, even in Combined mode. Activation lets you choose Detection or Prevention; see ruleset stages.
Paranoia levels
A WAF policy's paranoia level selects rules from levels 1–4, up to the selected level. Higher levels include more rules from the selected profiles and can produce more false positives.
The optional detection paranoia level lets additional levels run for observation. Leaving it unset runs only through the policy's paranoia level.
For example, paranoia level 1 with detection paranoia level 2 runs levels 1 and 2. Eligible level-1 matches can add blocking score; level-2 matches add only detection score. Review these findings before raising the paranoia level.
The policy editor sets both levels. Its detection-level selector offers levels above the paranoia level; the API fields ParanoiaLevel and DetectionParanoiaLevel also accept equal levels, which adds no extra rules. Use WAF detections to inspect the separate scores and the ruleset evaluations behind a request's decision.
Container labels
A Docker-discovered route's inline WAF policy uses clearplane.proxy.waf.scoring-mode, clearplane.proxy.waf.paranoia-level and clearplane.proxy.waf.detection-paranoia-level, alongside the required clearplane.proxy.waf.mode.
Container labels do not set per-ruleset thresholds; set them on the inline policy under Firewall → WAF policies. See the configuration catalog for the complete list.
See Scoring and integrity tests for response thresholds, Challenge actions and how rule authors test their releases.