Web Application Firewall:Rule library management

Built-in protection rules

Alibaba Cloud's security team maintains and updates the built-in protection rules. These rules are view-only.

1. Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region for your WAF instance (Chinese Mainland or Outside Chinese Mainland). In the left-side navigation pane, choose Detection and Response > Rule Libraries.

2. Click the System Protection Rules tab. This tab displays rule information on the left and recent rule updates on the right.

Custom protection rules

Custom protection rules apply only to assets under hybrid cloud protection. On this page, you can create, view, edit, and delete them.

Create a custom protection rule

1. Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region for your WAF instance (Chinese Mainland or Outside Chinese Mainland).

2. In the left-side navigation pane, choose Detection and Response > Rule Libraries.

3. In the Custom Protection Rules section, click Create Rule. Configure the following parameters and click OK.

   Parameter	Description
   Rule Name	The name of the custom protection rule. The name can contain Chinese characters, uppercase and lowercase letters, digits, periods (.), underscores (_), and hyphens (-).
   Module Name	The type of attack that the rule is designed to detect. Supported modules include SQL Injection, XSS, Code Execution, CRLF, Local File Inclusion, Remote File Inclusion, Webshell, Others, OS Command Injection, Expression Injection, Java Deserialization, PHP Deserialization, SSRF, Path Traversal, Protocol Non-compliance, Arbitrary File Upload, and File Inclusion.
   Rule Level	The strictness level of the rule. You can select Loose, Medium, Strict, or Super Strict.
   Status	The status of the rule. It is disabled by default. You can enable it on the Configure Engine page of a protection rule template.
   Rule Action	The action that WAF takes on a matching request. The default action for a new rule is Block. You can change this action in the Configure Engine panel of a protection rule template for Core Web Protection when you enable the rule.
   Rule Description	An optional description of the rule's conditions and purpose.
   Match Field	The part of a web request that the rule inspects. You can add up to 10 conditions to a rule. If a rule has multiple conditions, a request must meet all of them to be considered a match. Each condition consists of a Match Field, a Logical Operator, and Match Content. Examples: Example 1: Set Match Field to URI, Logical Operator to Contains, and Match Content to /login.php. The rule matches if the request URI contains /login.php. Example 2: Set Match Field to IP, Logical Operator to Belongs To, and Match Content to 192.1X.XX.XX. The rule matches if the request originates from the IP address 192.1X.XX.XX. For more information about match fields and logical operators, see match conditions.

   Note

   An Alibaba Cloud account and its RAM users share a limit of up to 200 custom protection rules.

4. The rule is created and an The operation is successful. message is displayed.

Enable a custom protection rule

After creating a custom protection rule, you must enable it in the engine configuration to apply it to your protected assets.

1. In the left-side navigation pane, choose Protection Config > Core Web Protection. In the Core Protection Rule section of the Core Web Protection page, find the target Rule Templates and click Edit in the Actions column.

2. In the Edit panel, click Configure Engine. In the Custom Protection Rules section, find the target rule and set its Status to On.

Edit a custom protection rule

On the Custom Protection Rules tab, click Edit in the Actions column for the rule you want to modify. In the Edit Rule dialog box, you can edit the Rule Name, Rule Level, Status, Rule Description, and Match Field. After you finish editing, click OK. A success message is displayed, and the page shows the updated rule information.

Delete a custom protection rule

On the Custom Protection Rules tab, find the rule that you want to delete and click Delete in the Delete column.