Overview

A Web Application Firewall (WAF) protects applications by identifying and blocking potentially malicious traffic. However, legitimate application requests can sometimes be incorrectly identified as threats, resulting in false positives.

Improperly handling false positives can either disrupt legitimate business operations or weaken application security through overly broad exclusions.

The GAJWAF Taming False Positives Playbook provides a structured approach to identifying, resolving and validating false positives while maintaining effective protection against genuine attacks.

The guiding principle is simple: Confirm. Fix Narrowly. Verify Both Ways.

Rather than disabling security features or reducing protection across an entire application, the playbook explains how to apply targeted corrections that address the affected traffic without unnecessarily exposing other application resources.

What You'll Learn

The playbook follows four essential stages:

Stage 1: Confirm the False Positive

Learn how to examine GAJWAF security events, identify the affected requests and determine whether the detected activity is legitimate or malicious.

The guide explains how to review event details, including detection rule IDs, categories, request paths, security scores and blocking actions.

Stage 2: Apply the Narrowest Possible Fix

Understand how to resolve false positives using the most targeted configuration change available.

The playbook introduces a four-level approach, starting with rule-specific exclusions and progressing to broader configuration changes only when necessary.

It covers:

  • Creating targeted exclusions using the Not an attack? option.
  • Using feature-specific field and path exceptions.
  • Configuring narrowly scoped custom allow rules.
  • Adjusting blocking sensitivity only when broader tuning is justified.

Stage 3: Verify That Security Remains Effective

Learn how to validate that the legitimate request is now permitted while ensuring that genuine attacks against the same endpoint are still detected.

This two-way verification helps prevent security gaps caused by overly permissive exclusions.

Stage 4: Apply Changes Across All GAJWAF Nodes

For multi-node deployments, ensure that updated security configurations and exclusions are consistently applied across every GAJWAF instance.

Common False-Positive Scenarios

The playbook also addresses practical situations administrators may encounter, including:

  • Legitimate application form submissions flagged as suspicious.
  • Rich-text editors triggering SQL injection or cross-site scripting detections.
  • API clients, webhooks and mobile applications encountering browser challenges.
  • Hidden-field modifications generated by application scripts.
  • Behavioral bot-detection events that do not necessarily indicate malicious activity.

Why This Playbook Matters

Effective WAF protection requires a balance between detecting malicious activity and allowing legitimate business operations.

Following this playbook helps administrators:

  • Minimize disruption to legitimate application users.
  • Resolve false positives without disabling entire detection categories.
  • Avoid overly broad security exclusions.
  • Preserve protection against genuine attacks.
  • Maintain consistent policies across multiple GAJWAF nodes.
  • Document security configuration changes for operational review.

Change Management and Validation

The playbook includes a change-record template to document the affected application, security event, detection rule, configuration adjustment and verification results.

Administrators can use this checklist to confirm that legitimate traffic is permitted, genuine attacks remain detectable and the required changes have been applied consistently.

Download the Playbook

Document: GAJWAF Playbook – Taming False Positives
Document Type: Security Operations Playbook
Publication: October 2026
Pages: 6
Intended Audience: GAJWAF Administrators and Security Analysts

Attachment: GAJWAF_Playbook_Taming_False_Positives.pdf

Download the attached PDF for detailed procedures, configuration references, examples and the security change-record checklist.

Related Documentation

For additional information, refer to:

Technical Support

For assistance with GAJWAF security policies, false-positive analysis or configuration, contact GajShield Technical Support or your authorized GajShield partner.

Website: https://www.gajshield.com

GAJWAF: Different Applications. Different Protection. Shared Risk Intelligence.