Validate Policies with Monitor Mode
Last update：2026-08-19 18:55:31
Reading time: About 5 minutes
What Is Monitor Mode
Monitor Mode is a validation phase before a policy goes into production. When enabled, the policy inspects all requests and records logs, but does not block any requests, so your business is completely unaffected.
When to use Monitor Mode:
- Initial policy configuration for a newly onboarded hostname
- Modifying existing rules (e.g., upgrading the WAF rule version, tightening rate limit thresholds)
- Adding a new custom rule when you are unsure whether it may cause false positives
How Long Should the Monitor Period Be
| Policy Type | Recommended Duration | Description |
|---|---|---|
| WAF Managed Rules | 3–7 days | Cover both weekday and weekend traffic patterns |
| Bot Management | 3–5 days | Understand the sources and behavior of bot traffic |
| Rate Limiting | 1–3 days | Determine the peak request frequency of normal traffic |
| Custom Rules | 1 day | Typically covers a well-defined scope, so a shorter observation period suffices |
| Threat Intelligence | No observation needed | Based on known malicious IP data, with an extremely low false positive rate |
How to Analyze Monitor Period Data
Step 1: Check Hit Counts
Go to Analysis & Logs > Web Security Trends and select the observation period. Focus on the following:
- Monitored Requests: Requests that were detected by the policy but not blocked
- Top Rules Triggered: Which rules matched the most requests
Step 2: Determine Whether Hits Are False Positives
Click a rule with a high hit count and review the corresponding attack logs. Use the following criteria:
| Characteristic | Likely False Positive | Likely Real Attack |
|---|---|---|
| Source IP | Known legitimate services (partners, monitoring tools, internal systems) | Anonymous proxies, VPNs, data center IP ranges |
| Request path | Normal business path (/api/v1/search) |
Unusual path (/admin/config, /.env) |
| User-Agent | Normal browser, known crawler (Googlebot) | Empty UA, abnormal string |
| Time distribution | Evenly distributed, consistent with business patterns | Dense requests within a short period |
Step 3: Handle False Positives
Once a hit is confirmed as a false positive, you have two options:
- Add an exception for the rule (recommended): Skip rule detection for specific requests only → See Add Exceptions to WAF Rules
- Change the rule action to Allow: Use only when a rule systematically generates false positives for a certain type of legitimate traffic, and the issue cannot be resolved with precise exception conditions
Step 4: Switch to Block Mode
You can safely switch to Block Mode when all of the following conditions are met:
- Each of the Top 10 rules with the highest hit counts during the observation period has been reviewed (confirmed as real attacks or handled as false positives)
- Known legitimate bots (monitoring tools, partners) have been added as exceptions or to the custom bot whitelist
- Rate limit thresholds are at least 1.5 times the peak request frequency of normal business traffic
How to switch: On each policy configuration page, change the mode from Log to Block, then click Deploy.