---
description: Example of how OWASP paranoia level and score threshold interact.
title: OWASP evaluation example
image: https://developers.cloudflare.com/og-docs.png
---

[Skip to content](#main-content)

> Documentation Index  
> Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt  
> Use this file to discover all available pages before exploring further.

# OWASP evaluation example

Last updated Aug 25, 2026|Copy as Markdown| [View as Markdown](https://d1-custom-bindings-docs.previews.developers.cloudflare.com/waf/managed-rules/reference/owasp-core-ruleset/example/index.md)| [Agent setup](https://d1-custom-bindings-docs.previews.developers.cloudflare.com/agent-setup/)

The following example calculates the OWASP request threat score for an incoming request. The OWASP managed ruleset configuration is the following:

- OWASP Anomaly Score Threshold: *High - 25 and higher*
- OWASP Paranoia Level: *PL3*
- OWASP Action: *Managed Challenge*

This table shows the progress of the OWASP ruleset evaluation:

| Rule ID | Paranoia level | Rule matched? | Rule score | Cumulative<br>threat score |
| --- | --- | --- | --- | --- |
| – | – | – | – | 0 |
| `...1813a269` | PL3 | Yes | +5 | 5 |
| `...ccc02be6` | PL3 | No | – | 5 |
| `...96bfe867` | PL2 | Yes | +5 | 10 |
| `...48b74690` | PL1 | Yes | +5 | 15 |
| `...3297003f` | PL2 | Yes | +3 | 18 |
| `...317f28e1` | PL1 | No | – | 18 |
| `...682bb405` | PL2 | Yes | +5 | 23 |
| `...56bb8946` | PL2 | No | – | 23 |
| `...e5f94216` | PL3 | Yes | +3 | 26 |
| (...) | (...) | (...) | (...) | (...) |
| `...f3b37cb1` | PL4 | (not evaluated) | – | 26 |

Final request threat score: `26`

Since `26` >= `25` — that is, the threat score is greater than the configured score threshold — Cloudflare will apply the configured action (*Managed Challenge*). If you had configured a score threshold of *Medium - 40 and higher*, Cloudflare would not apply the action, since the request threat score would be lower than the score threshold (`26` < `40`).

[**Sampled logs** in Security Events](https://d1-custom-bindings-docs.previews.developers.cloudflare.com/waf/analytics/security-events/#sampled-logs) would display the following details for the example incoming request handled by the OWASP Core Ruleset:

![Event log for example incoming request mitigated by the OWASP Core Ruleset](https://d1-custom-bindings-docs.previews.developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1160,height=818,format=webp/_astro/owasp-example-event-log.B3Lc0T9C.png)

In sampled logs, the rule associated with requests mitigated by the Cloudflare OWASP Core Ruleset is the last rule in this managed ruleset: `949110: Inbound Anomaly Score Exceeded`, with rule ID ...843b323c. To get the scores of individual rules contributing to the final request threat score, expand **Additional logs** in the event details.

Was this helpful?

YesNo

## On this page

[![](https://d1-custom-bindings-docs.previews.developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://d1-custom-bindings-docs.previews.developers.cloudflare.com/)

```json
{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/waf/managed-rules/reference/owasp-core-ruleset/example/#page","headline":"OWASP evaluation example · Cloudflare Web Application Firewall (WAF) docs","description":"Example of how OWASP paranoia level and score threshold interact.","url":"https://developers.cloudflare.com/waf/managed-rules/reference/owasp-core-ruleset/example/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-08-25","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}
```