When researching how to use observe only mode while testing WAF protection, the first task is to verify what the documentation actually supports. The supplied SafeLine documents explain installation, reverse proxy setup, application onboarding, and attack testing. They do not document an observe only switch, a detection without blocking setting, or instructions for enabling such a mode. Treat the workflow below as a setup and evaluation checklist, not as confirmation that SafeLine offers that capability.
An observation phase can help a team understand how legitimate requests interact with a proposed security policy. However, a test environment running active protection is different from a configuration that records detections while allowing requests through. Keep that distinction explicit throughout your evaluation.
1. Define the test scope and acceptance criteria
Choose an application you control, preferably a staging instance with representative workflows and disposable test data. List the requests that must succeed: sign-in, search, form submissions, API calls, file uploads, and any unusual input formats your application accepts.
For each workflow, record the expected response and application outcome. Decide how you will investigate an unexpected block and who can approve a later production change. These are evaluation practices, not documented SafeLine configuration options.
SafeLine's documented architecture places it in front of the application as an HTTP/HTTPS reverse proxy. Requests reach SafeLine before being forwarded to the upstream application. This means your test plan must verify the traffic path as well as application behavior. Official application setup guide
2. Prepare and install a test instance
Check the host against the official deployment requirements. The guide lists Linux, Docker 20.10.14 or later, Docker Compose 2.0.0 or later, and a minimum environment of one CPU core, 1 GB of memory, and 5 GB of disk space. It also lists architecture and CPU instruction requirements; review those details before selecting your host. Official deployment guide
Follow the deployment guide's automatic or manual installation procedure. The automatic installer requires root privileges. After installation, the guide directs you to the web console at https://<safeline-ip>:9443/ and documents docker exec safeline-mgt resetadmin for obtaining administrator credentials. Official deployment guide
Use the current official procedure rather than building an installation command from assumptions about environment variables or container settings.
3. Configure the application traffic path
In the SafeLine Web Admin Console, open Applications and select Add Application. Supply the application's domain, the port SafeLine should listen on, and the upstream address of the original application. For an HTTPS application, the guide instructs you to select the SSL option. Then resolve the configured domain to the SafeLine server's IP address. Official application setup guide
For a controlled evaluation, use a dedicated test hostname and upstream. Confirm that ordinary requests reach the intended application through this route before interpreting any security results.
4. Verify the available protection controls
Before sending test traffic, establish whether your installed version has a documented setting that matches your intended observe only behavior. You need an explicit answer about whether matching requests are allowed, blocked, or otherwise affected.
The supplied sources describe filtering, monitoring, and blocking malicious HTTP/S traffic. They do not establish that monitoring can be selected independently of blocking. Do not infer a passive operating mode from the word "monitoring." Official SafeLine overview
If you cannot verify the required behavior, continue in an isolated test environment with the expectation that protection may block requests. That supports compatibility testing, but it does not demonstrate observe only operation.
5. Evaluate legitimate traffic and controlled attack cases
Run your legitimate workflow checklist first. Record unexpected responses alongside the request details and expected business outcome. Include less common but valid inputs so that your assessment covers more than a successful homepage request.
Next, use controlled attack cases only against your authorized test application. The official setup guide provides examples for SQL injection, XSS, path traversal, code injection, and XXE. It describes a blocking page as evidence of a blocked test and directs administrators to the attack list and its detail view for investigation. Official application setup guide
Keep legitimate traffic results separate from attack detection results. A successful block does not establish compatibility with all application workflows, and a successful normal request does not establish complete protection.
FAQ
Does the supplied documentation explain how to enable observe only mode?
No. It documents deployment, application setup, and blocking tests, but provides no observe only configuration procedure. An exact activation sequence cannot be grounded in these sources.
Can I use staging to evaluate compatibility?
Yes. A staging evaluation can compare expected application behavior with observed results while keeping test traffic controlled. It remains a testing method rather than evidence of a specific SafeLine operating mode.
Where can I inspect a documented attack test?
The application setup guide directs you to the SafeLine web console's attack list and the detail view for individual attacks. Official application setup guide
When should I move beyond the initial evaluation?
Proceed when representative legitimate workflows meet your acceptance criteria, unexpected blocks have been investigated, and you understand the behavior of the protection settings you intend to deploy. If passive observation is a requirement, verify that capability through applicable official documentation before relying on it.
SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.
- SafeLine website: https://ly.cyberserval.tech/bvK1BAV
- Demo: https://demo.waf.chaitin.com:9443/statistics
- Official docs: https://docs.waf.chaitin.com/en/home
- GitHub: https://github.com/chaitin/SafeLine
- Pro offer: https://cyberserval.tech/landing/lto
Top comments (0)