Asset management - Web Application Firewall - Alibaba Cloud Documentation Center

The AI application protection feature of Web Application Firewall (WAF) uses assets to locate and inspect user inputs (requests) and model outputs (responses) in AI applications. After you create an asset, you can enable prompt attack prevention or content moderation for it.

Add an asset

You must have an existing protected object (that is, your web service is already onboarded to WAF) before performing the following steps. If you have not onboarded your services to WAF, see Onboarding overview.

Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance., in the left-side navigation pane, choose Protection Config > AI Application Protection. On the Asset Management tab, click Add Asset.

Specify the Match Condition. Match Conditions are required. They define the AI API endpoints you want to protect and help WAF accurately identify the target traffic.

Match field	Match content
Domain Name	Enter a domain name or IP address. For example, if the domain name of your protected object is `domain.com`, enter `domain.com`.
URL Path	Enter the URL path of the API. For example, if you enter `/chat/message` here and `domain.com` for Domain Name, the protected target is `domain.com/chat/message`.
HTTP Request Method	Options: `POST`, `GET`, `PUT`.

In the Prompt Position and Response Content sections, specify content position fields to enable WAF to locate the content to be inspected in an HTTP message. The fields must conform to JSONPath expressions.

Important

This configuration directly affects which content the downstream protection modules inspect.

To configure WAF to inspect both user requests and model responses, you must configure both Prompt Position and Response Content here.
To configure the Custom Response action, you must configure Response Content here.

Under Response Content, select the following configuration items based on your service characteristics.

Non-streaming Response: After processing is complete, the server returns the complete JSON response body in a single response. The client must wait until all data is generated before receiving the result.
Streaming Response: The server continuously pushes response data in chunks. The client can receive and process partial results in real time until the connection is closed. Only the SSE protocol is supported.
- Deep Thinking: Before generating the final answer, the model explicitly outputs its reasoning process in structured steps to improve the interpretability and accuracy of the results.

Note

If you are unsure about the content position fields, refer to the following examples to determine the correct values. You can also click Test next to the input box to validate your configuration.

Request prompt position examples

Example 1

In the following HTTP request body, the JSONPath for the prompt position is: $.messages[0].content.parts[0].

{
  "action": "next",
  "messages": [{
    "id": "c86043d3-6657-4a9e-85df-a22c98666367",
    "create_time": 1742977262.085,
    "content": {
      "content_type": "text",
      "parts": ["What is a large model prompt?"]
    }
  }]
}

Example 2

In the following HTTP request body, the JSONPath for the prompt position is: $.messages[1].content.

{
  "model": "gpt-3.5-turbo",
  "messages": [
    {
      "role": "system",
      "content": "You are an assistant."
    },
    {
      "role": "user",
      "content": "Help me write a thank-you letter."
    }
  ],
  "temperature": 0.7
}

Example 3

In the following HTTP request body, the JSONPath for the user prompt in the last turn is: $.messages[-1].content.

{
  "messages": [
    {
      "role": "user",
      "content": "Explain neural networks."
    },
    {
      "role": "assistant",
      "content": "A neural network is a computational model that simulates the structure of the human brain..."
    },
    {
      "role": "user",
      "content": "What about a Transformer?"
    }
  ]
}

Response content position examples

Non-streaming Response

In the following HTTP response body, the JSONPath for the response content position is: $.choices[0].message.content.

{
  "choices": [
    {
      "message": {
        "role": "assistant",
        "content": "A large model prompt is the input text that guides the model to generate a specific output."
      }
    }
  ]
}

Streaming Response

The following HTTP response body contains five content chunks. The JSONPath for the content path of each chunk is: $.answer.

  data: {"event": "message", "message_id": "5adxxx6290", "conversation_id": "457xxx55f2", "answer": "Nice", "created_at": 1679586595}
  data: {"event": "message", "message_id": "5adxxx6290", "conversation_id": "457xxx55f2", "answer": "to", "created_at": 1679586595}
  data: {"event": "message", "message_id": "5adxxx6290", "conversation_id": "457xxx55f2", "answer": "see", "created_at": 1679586595}
  data: {"event": "message", "message_id": "5adxxx6290", "conversation_id": "457xxx55f2", "answer": "you", "created_at": 1679586595}
  data: {"event": "message_end", "id": "5adxxx6290", "conversation_id": "457xxx55f2", "metadata": {} }

Deep Thinking

In the following HTTP response body, the JSONPath for the deep thinking position is: $.choices[0].delta.reasoning_content.

data: {"choices":[{"delta":{"content":null,"role":"assistant","reasoning_content":""},"index":0,"logprobs":null,"finish_reason":null}],"object":"chat.completion.chunk","usage":null,"created":1758787252,"system_fingerprint":null,"model":"deepseek-v3.1","id":"chatcmpl-xxx-e30c1"}
data: {"choices":[{"finish_reason":null,"logprobs":null,"delta":{"content":null,"reasoning_content":"Well"},"index":0}],"object":"chat.completion.chunk","usage":null,"created":1758787252,"system_fingerprint":null,"model":"deepseek-v3.1","id":"chatcmpl-xxx-e30c1"}
data: {"choices":[{"delta":{"content":null,"reasoning_content":", the user"},"finish_reason":null,"index":0,"logprobs":null}],"object":"chat.completion.chunk","usage":null,"created":1758787252,"system_fingerprint":null,"model":"deepseek-v3.1","id":"chatcmpl-xxx-e30c1"}
data: {"choices":[{"delta":{"content":null,"reasoning_content":" asked a"},"finish_reason":null,"index":0,"logprobs":null}],"object":"chat.completion.chunk","usage":null,"created":1758787252,"system_fingerprint":null,"model":"deepseek-v3.1","id":"chatcmpl-xxx-e30c1"}
data: {"choices":[{"delta":{"content":null,"reasoning_content":" basic"},"finish_reason":null,"index":0,"logprobs":null}],"object":"chat.completion.chunk","usage":null,"created":1758787252,"system_fingerprint":null,"model":"deepseek-v3.1","id":"chatcmpl-xxx-e30c1"}
data: {"choices":[{"delta":{"content":null,"reasoning_content":" self-introduction question."},"finish_reason":null,"index":0,"logprobs":null}],"object":"chat.completion.chunk","usage":null,"created":1758787252,"system_fingerprint":null,"model":"deepseek-v3.1","id":"chatcmpl-xxx-e30c1"}
data: {"choices":[{"delta":{"content":"I am DeepSeek","reasoning_content":null},"finish_reason":null,"index":0,"logprobs":null}],"object":"chat.completion.chunk","usage":null,"created":1758787252,"system_fingerprint":null,"model":"deepseek-v3.1","id":"chatcmpl-xxx-e30c1"}
data: {"choices":[{"delta":{"content":"What can","reasoning_content":null},"finish_reason":null,"index":0,"logprobs":null}],"object":"chat.completion.chunk","usage":null,"created":1758787252,"system_fingerprint":null,"model":"deepseek-v3.1","id":"chatcmpl-xxx-e30c1"}
data: {"choices":[{"delta":{"content":" I","reasoning_content":null},"finish_reason":null,"index":0,"logprobs":null}],"object":"chat.completion.chunk","usage":null,"created":1758787252,"system_fingerprint":null,"model":"deepseek-v3.1","id":"chatcmpl-xxx-e30c1"}
data: {"choices":[{"delta":{"content":" do","reasoning_content":null},"finish_reason":null,"index":0,"logprobs":null}],"object":"chat.completion.chunk","usage":null,"created":1758787252,"system_fingerprint":null,"model":"deepseek-v3.1","id":"chatcmpl-xxx-e30c1"}
data: {"choices":[{"finish_reason":"stop","delta":{"content":" for you?"},"index":0,"logprobs":null}],"object":"chat.completion.chunk","usage":null,"created":1758787252,"system_fingerprint":null,"model":"deepseek-v3.1","id":"chatcmpl-xxx-e30c1"}
data: [DONE]

Set Associate with Protected Object. Each asset can be associated with only one protected object.

Next steps

After an asset is created, it does not have protection capabilities. Configure a prompt attack prevention or content moderation protection template for the asset as needed.

View and manage assets

On the Asset Management tab, you can view and manage your assets.

View the protection template associated with an asset: In the Associated Protection Template column, check the binding status between protection templates and the asset. Click a protection template to go to the Rule Templates tab to view the corresponding template. If this column is empty, the asset does not have any protection template applied and is not protected.
Edit an asset: In the Actions column, click Edit to modify the Prompt Position and Response Content for an existing asset.
Delete an asset: In the Actions column, click Delete to remove the asset. After an asset is deleted, it is no longer protected.

Limitations

The Match Condition and Associate with Protected Object of an asset cannot be modified after the asset is created.
Each asset can be associated with only one protected object.
Streaming responses support only the SSE protocol.