WAF configurations
The WafConfig entity — what it controls and what each field costs you.
Rulesets
Naming a body of SecLang so more than one configuration can run it.
Rules and the CRS
SecLang directives, the embedded Core Rule Set, phases and paranoia levels.
WAF plugins
The two plugins that run a WAF configuration, and where each one is configured.
Tuning
Getting from monitoring mode to blocking without breaking production traffic.
Tuning assistant
Turning an observed false positive into an exclusion that has been proven to work, and whose cost is known before it is saved.
Learning mode
Run a configuration in monitoring for a window, then read what it would actually cost to arm it.
Upload guard
Judging uploaded files by what they are, not by what they say they are.
Rule feeds
Signed rule packs and virtual patches, checked by the gateway before they are installed.