Web Application Firewall:Configure threat intelligence rules

Key concepts

• threat intelligence: A WAF protection module that automatically identifies and blocks web attack source IP addresses from around the world without requiring you to manually configure complex rules. To enable this module, you must create a threat intelligence protection template. You can create multiple templates.

• protection template: A collection of rules that defines the specific rule content and its scope. A template consists of three parts: template type, protection rules, and scope.

  • Template type: You must specify a type when creating a template, and it cannot be changed later. There are two types of templates:

    Template type	Description	Use cases
    default template	When created, the template applies to all protected objects and object groups by default. Newly added objects are also automatically included. You can manually exclude specific objects by setting their status to "Not applied". You can only have one default template in the threat intelligence module.	To deploy general-purpose rules that apply globally.
    custom template	You must manually specify the protected objects or protected object groups to which it applies.	To deploy fine-grained rules for specific services.

  • protection rule: Defines the specific detection logic and response action. Each rule consists of two parts:

    • rule type: Specifies the type of threat to detect. Supported types include Website Scanning, Exploitation, and Tor IP.

    • rule action: Defines the action to take when a request matches a rule. The actions are prioritized from highest to lowest as follows: block, strict slider CAPTCHA, slider CAPTCHA, JS challenge, and monitor.

  • scope: Specifies the targets to which the template applies. By setting the scope, you apply protection rules to specific protected objects or protected object groups. A protected object or object group can be associated with only one threat intelligence template.

    • protected object: The system automatically creates a protected object for each domain name or cloud service instance that is added to WAF.

    • protected object group: You can add multiple protected objects to a protected object group for centralized management.

Step 1: Configure the threat intelligence template type

On the Core Web Protection page, in the Threat Intelligence section, click Create Template. In the Create Template - Threat Intelligence panel, complete the following settings.

• Template Name: Enter a name for the template.

• Save as Default Template: You can only have one default template in the threat intelligence module, and it can only be set as the default during creation.

  • Yes: You do not need to configure the Apply To. When created, the template applies to all protected objects and object groups by default. Newly added objects are also automatically included. You can manually exclude specific objects.

  • No: You must configure the Apply To by manually specifying the protected objects or protected object groups to which the template applies.

Step 2: Configure protection rules

In the Rule Configuration section, complete the following settings.

• Rule type: Select the rule type based on your business needs to defend against specific types of attacks.

  Rule type	Description
  Website Scanning	These IP addresses use automated tools to probe websites to identify the technology stack, open ports, potential security vulnerabilities, or collect other related information.
  Exploitation	These IP addresses exploit security vulnerabilities in web applications to perform malicious operations, gain unauthorized access, and potentially cause damage.
  Tor IP	These IP addresses are exit nodes of the Tor network. They represent traffic from users who access the internet anonymously through Tor.

• Rule Action: Select the action to take when a request matches the rule.

  Parameter	Description
  JavaScript Validation	WAF returns a JavaScript snippet to the client for validation. A standard browser automatically executes this code. If the client's browser executes the code successfully, WAF allows all requests from that client for a period (30 minutes by default). Otherwise, WAF blocks the requests.
  Block	Blocks requests that match the rule and returns a block response page to the client. Note WAF uses a default block page. You can also use the Custom Response feature to customize the block page.
  Log	Allows requests that match the rule but records the match in the logs. When you test a new rule, you can first use the Log mode to analyze WAF logs and confirm that the rule does not block legitimate requests, and then switch to a different rule action.
  CAPTCHA	WAF returns a CAPTCHA page to the client. If the client successfully completes the CAPTCHA, WAF allows all requests from that client for a period (30 minutes by default). Otherwise, WAF blocks the requests. Note For a WAF instance that uses the pay-as-you-go billing method, this rule action incurs additional fees. For more information, see Pay-as-you-go billing details.
  Strict CAPTCHA	WAF returns a CAPTCHA page to the client. If the client successfully completes the CAPTCHA, WAF allows the request. Otherwise, WAF blocks it. In this mode, every request from the client that matches this rule requires CAPTCHA verification. Note For a WAF instance that uses the pay-as-you-go billing method, this rule action incurs additional fees. For more information, see Pay-as-you-go billing details.

  Note

  • The CAPTCHA action is available only on subscription (Enterprise or Ultimate Edition) and pay-as-you-go WAF instances.

  • JavaScript Validation and CAPTCHA actions apply only to synchronous requests. For asynchronous requests, such as those made with XMLHttpRequest or the Fetch API, you must inject the Web SDK. Otherwise, these features will not work correctly. For more information, see the JavaScript validation and CAPTCHA sections in Bot management.

  • After you enable JavaScript Validation or CAPTCHA and the client passes the verification, WAF uses Set-Cookie to set a cookie named acw_sc__v2 (for JavaScript Validation) or acw_sc__v3 (for CAPTCHA) in the response header. The client then includes this identifier in the Cookie header of subsequent requests.

• Advanced Settings (Optional):

  Parameter	Description
  Canary Rule	Configures the percentage of traffic to which the rule applies, based on a specific dimension. After you enable canary release, you also need to configure the Dimension and Canary Release Proportion. The Dimension includes: IP, Custom Header, Custom Parameter, Custom Cookie, and Session. Note Canary release takes effect based on the configured Dimension, rather than applying the rule to a random percentage of all requests. For example, if you set the Dimension to IP and the Canary Release Proportion to 10%, WAF selects approximately 10% of all source IP addresses. All requests from the selected IP addresses are subject to the rule; the rule is not randomly applied to 10% of all requests.
  Effective Mode	Permanently Effective (Default): The rule is always active when the protection template is enabled. Fixed Schedule: The protection rule is active only during a specified time range. Recurring Schedule: The protection rule is active only during a specified recurring time period.

Step 3: Set the template scope

In the Apply To section, select the protected objects and protected object groups to which you want to apply this template.

How the template is applied depends on your configuration in Step 1:

• If you set it as the default template: You do not need to configure the scope. The template automatically applies to all existing and future protected objects and object groups. You can manually exclude specific objects.

• If you did not set it as the default template: You must manually specify the protected objects and protected object groups for the scope.

Common operations