After you add your domain name to Web Application Firewall (WAF), you can configure a whitelist for web intrusion prevention to allow requests that meet specific criteria to bypass detection by the Protection Rules Engine. A web intrusion prevention whitelist is typically used to allow legitimate business requests that were incorrectly blocked by web intrusion prevention rules.
Prerequisites
-
You have activated a Web Application Firewall instance.
-
Your website has been added to WAF. For more information, see Tutorials.
Background information
Web intrusion prevention protects your domain name against common web attacks, provides rapid responses to zero-day vulnerabilities, and ensures your domain's security. For more information, see Protection Rules Engine.
If this protection module blocks legitimate requests, you can configure a whitelist for web intrusion prevention to let requests that meet specific conditions bypass detection. Create whitelist rules based on your business needs to allow only intended traffic.
Procedure
-
Log on to the Web Application Firewall console.
-
In the top menu bar, select the resource group and region for your Web Application Firewall instance (Chinese Mainland or Outside Chinese Mainland).
-
In the left navigation pane, choose .
-
On the Website Protection page, switch to the domain name to configure.
-
On the Web Security tab, in the Web Intrusion Prevention section, click Configure Now.
-
Create a whitelist rule for web intrusion prevention.
-
On the Web Intrusion Prevention - Whitelist page, click Create.
-
In the Create Rule dialog box, configure the rule parameters as described in the following table. Multiple matching conditions are linked by AND logic. You can specify up to five conditions. For each condition, you must set Match Field, Logic, and Match Content. For Bypassed modules, you can select Protection Rules Engine or deep learning engine. For the rule scope, you can select All Rules, Specific rule ID, or Specific rule type. After you complete the configuration, click Save.
Parameter
Description
Rule Name
Specify a name for the rule.
The name can contain uppercase letters, lowercase letters, digits, and Chinese characters. The name can be up to 50 characters long.
Match Condition
Set the conditions (features) that a request must meet. Click Add Condition to add up to five conditions. If multiple conditions are added, they must all be met for the request to be considered a match.
For more information about the fields for a matching condition, see Fields in a matching condition.
Bypassed Modules
Select the protection modules to bypass. Valid value: Protection Rules Engine.
After you select the Protection Rules Engine, by default, it does not inspect the rules in the All Rules group. You can also configure it to ignore only specific rules or rule types, as needed. The configuration method is as follows:
-
Select Protection Rules Engine.
-
Optional: To bypass only specific rules, select IDs of Specific Rules and enter the ID of the rule to bypass, for example,
115128.On the Protection Rule Group page, you can select Create Rule Group to view all Web attack protection rules that are included in WAF and obtain their IDs. For more information, see Custom Protection Rule Group.
Press the Enter key after you enter each rule ID. You can enter up to 50 rule IDs.
NoteYou can also go to the Security Report page and use the Ignore False Positives feature in the Web Intrusion Prevention report to add a web intrusion prevention whitelist rule for a specific rule ID. The Ignore False Positives feature automatically generates a whitelist rule based on the characteristics of an attack request. You do not need to manually configure matching conditions or look up rule IDs. For more information about the Ignore False Positives feature, see Web Security Report.
-
Optional: To bypass only specific rule types, select Specific Types of Rules, select the rule types to bypass, and then click OK. The available rule types include SQL injection, cross-site scripting, code execution, CRLF, local file inclusion, remote file inclusion, webshell, CSRF, custom rules, and other.
-
-
Click Save.
After a whitelist rule is created, it is automatically enabled. You can view the new rule in the rule list and disable, edit, or delete it as needed.
ImportantBy default, whitelist rules are valid indefinitely. If you no longer need a rule, you can disable or delete it.
-