LEARN. PRACTICE. GROW.Concept and mechanism
A false positive occurs when legitimate traffic is incorrectly classified. Counting blocks is insufficient: identify the rule, field, operation, and legitimacy of the example using controlled data. With anomaly scoring, contributions can accumulate before a decision. In the exercise, three and two points sum to five and meet a threshold of five. Paranoia level and threshold are different parameters: increasing the former adds rule coverage and can increase tuning needs. Do not present a higher level as improvement without operational cost. Measure legitimate-operation success alongside the ability to detect cases that should be blocked.
Guided application
An exclusion should match known evidence. If only one parameter in one operation causes the issue, removing an entire category affects other paths without demonstrated justification. Keep adaptations separate from files distributed with CRS to avoid losing them during updates. Record reason, owner, scope, and review; test the legitimate case and coverage that should remain. In a labeled set of two hundred legitimate requests, twenty incorrect blocks represent ten percent in that set without proving a rate for all future traffic. The reconciliation cases in this course are original and do not prescribe internal rules for any bank.
20 / 200 = 10% false positives in the stated legitimate sample.
Common pitfalls
A block as confirmed attack; an entire category for one field; threshold as paranoia level; sample as population.
Related topics: WAF architecture and coverage · Order, actions, and overrides · Parsing and inspection limits
Tune within the smallest justified scope and measure recovery and coverage.
Reference: OWASP CRS false positives and exclusions · DR WAF 2026-09; selected AWS WAF and OWASP CRS operational concepts