Security Center:Manage protection policies

Built-in policy groups

To meet security requirements in different business scenarios, application protection provides tiered detection rules and built-in protection policy groups: Business First (default loose rule group), Normal Operations (default standard rule group), and Protection First (default strict rule group).

All rules within a built-in policy group share the same detection mode. For example, all attack rules in the Business First group (default loose rule group) use the Loose detection mode. You can use a built-in rule group as needed or create a custom rule group.

Detection modes

To balance false positive rates and protection strength across different business scenarios, application protection defines multiple detection modes: Loose, Standard, and Strict. These three modes provide increasing protection capability and increasing false positive rates.

• Loose: Matches only known attack signatures. Very low false positive rate.

• Standard (default): Matches common attack patterns and applies some generalized inference. Suitable for daily O&M.

• Strict: Detects more hidden attack behaviors. Suitable for major event support scenarios, but has a certain risk of false positives.

Create a protection policy group

If none of the built-in policy groups fit your needs, create a custom one. To base a new group on an existing configuration, click Copy in the Actions column for that group.

1. Log on to the Security Center console.

2. In the navigation pane on the left, choose Protection Configuration > Application Protection. In the upper-left corner, select the region where your asset is located: Chinese Mainland or Outside Chinese Mainland.

3. On the Application Configurations tab, click Management Settings in the upper-right corner.

4. In the Management Settings panel, on the Manage Protection Policy tab, click Create Protection Policy Group.

5. In the Create Protection Policy Group panel, enter a name, select an application language, and click Select to the right of Threat Type to configure the detection types.

6. In the Select Threat Type panel, select the detection types to include, set the Detection Mode for each type, and click OK.

   For example, if alerts for SQL injection contain many false positives, set the detection mode for that type to Loose.

   Available detection types include Malicious Outbound Connection (medium risk), Expression Injection (high risk), Arbitrary File Deletion (low risk), JNI Injection (high risk), and more. Each type includes a description and risk level for reference.

7. Click OK.

Add a whitelist rule from an alert

If an alert is confirmed as a false positive, add it to the protection whitelist to prevent similar alerts from being generated in the future. When you add an alert to the whitelist, a rule is automatically created from the alert details and applied to the application group that contains the affected process.

For steps, see Add an alert to a whitelist.

View and manage whitelist rules

1. Log on to the Security Center console.

2. In the navigation pane on the left, choose Protection Configuration > Application Protection. In the upper-left corner, select the region where your asset is located: Chinese Mainland or Outside Chinese Mainland.

3. On the Application Configurations tab, click Management Settings in the upper-right corner.

   You can also click Protection Whitelist on the Attack Alerts tab to view the whitelist rule list.

4. In the Management Settings panel, on the Protection Whitelist tab of the Manage Protection Policy tab, view the list of whitelist rules.

   You can manage whitelist rules by using the following operations:

   • Enable or disable: Toggle the switch in the Rule Switch column to enable or disable a whitelist rule.

   • Edit or delete: Click Edit or Delete in the Actions column to modify or delete a whitelist rule.

Create a whitelist rule manually

A manually created rule lets you configure whitelists for multiple detection types across multiple application groups.

1. Log on to the Security Center console.

2. In the navigation pane on the left, choose Protection Configuration > Application Protection. In the upper-left corner, select the region where your asset is located: Chinese Mainland or Outside Chinese Mainland.

3. On the Application Configurations tab, click Management Settings in the upper-right corner.

   You can also click Protection Whitelist on the Attack Alerts tab.

4. In the Management Settings panel, on the Protection Whitelist tab of the Manage Protection Policy tab, click Create Whitelist.

5. In the Create Whitelist panel, configure the rule parameters and click OK.

   The following describes some of the parameters. For other parameters, refer to the descriptions in the console.

   • Match Mode: Select the match method for the whitelist rule. Options:

     • Exact Match: Suppresses alerts when the transmitted content is identical to the match content.

     • Partial Match: Suppresses alerts when the transmitted content contains the match content.

     • Prefix Match: Suppresses alerts when the transmitted content starts with the match content.

     • Suffix Match: Suppresses alerts when the transmitted content ends with the match content.

   • Content to Match: Set the match content based on the selected match method. You can use the value of Malicious Characteristics, Specified Parameters, or Request URL from the alert details page as the match content.