Switching a production app straight to Protection without baseline traffic invites false blocks. FLY Enterprise WAF supports a phased rollout using modes that exist in product code today.
Modes (per application)
- Reporting — learn Method + URL routes; log would-block; forward all traffic
- Detection-only — evaluate rules and log blocks; still forward traffic
- Protection — enforce Allow / Block / Challenge
- Offline — pass-through for maintenance
Phase 1 — Reporting (1–2 weeks typical)
Let legitimate traffic populate the route baseline. Review:
- Learned routes (Method + URL) in Positive Security views
- “Would block” signals in logs — not yet enforced
- Unexpected paths that may need backend fixes before Protection
Phase 2 — Analyst review
Use SOC Queue and attack reports to prioritize noisy rules. Check static-asset SQL alerts for likely false positive labels before changing global modules.
Phase 3 — Detection-only
Validate that blocks logged match expectations while users still reach the app. Compare decision explanation metadata with manual spot-checks on critical flows (login, checkout, API POST).
Phase 4 — Protection
Enable enforcement. Continue tuning: IP/UA exceptions, detect-only on specific modules, virtual patches for emergency CVE-style patterns.
Honest limit: Route learning does not learn parameters or JSON bodies. APIs needing contract enforcement still require optional OpenAPI upload — separate from this rollout.