Web Application Firewall:API security policy configuration

Detection condition reference

The following table lists all supported match fields and their logical operators.

Data statistics condition reference

Data masking

The De-identification Display switch controls whether sensitive data is masked in the console. It is disabled by default.

When enabled, the following data is masked:

• In Risk Details and API Details: sensitive data in all request and response sample fields is replaced with a placeholder such as {{Phone}}.

• In Event Details: request and response data samples that contain sensitive data are masked as {}.

• In sample information: Request Cookie is masked as {{Cookie}}, a Request Header containing a token is masked as {{XXXToken}}, and Response Set-Cookie is masked as {{SetCookie}}.

Masking applies as follows:

• Risk Details and API Details: applies only to new request and response data samples.

• Event Details: applies to both new and existing request and response data samples.

Built-in policies

Built-in sensitive data policies are read-only. You can enable or disable them, but cannot edit or delete them.

Create a custom sensitive data policy

If your business uses custom sensitive data types, create custom detection rules. You can create up to 20 custom policies.

1. On the API Security page, go to Policy Configuration > Sensitive Data-related Configurations.

2. Click Create Policy.

3. In the panel that appears, configure the following parameters. You can use Basic mode or Expert mode.

   Parameter	Description
   Name	Set a name for the rule. The name can contain Chinese characters, uppercase and lowercase letters, digits, periods (.), underscores (_), and hyphens (-).
   Mode	Basic: Provides a simple interface. Set Characters (one or more character types: digits, uppercase letters, lowercase letters) and Length (range: 6–64, integer start and end values). Expert: Supports regular expressions. Enter a regular expression for detection. To avoid false positives, make sure the expression matches at least 6 characters.
   Sensitivity level	Set the sensitivity level. Valid values: S1, S2, S3, and S4. For details, see What sensitive data can API Security detect.

4. Click OK.

Create a custom authentication credential policy

1. On the API Security page, go to Policy Configuration > Authentication Credential Configurations.

2. Click Create Policy.

3. Configure the following parameters, then click OK.

   Parameter	Description
   Name	Set a name for the policy. The name can contain Chinese characters, uppercase and lowercase letters, digits, periods (.), underscores (_), and hyphens (-).
   Match condition	Each condition consists of a Match Field, a Logical Operator, and Match Content. Add up to 10 conditions, including at least one for Request Header, Request Cookie, Request Query, or Request Body. If you define multiple conditions, a rule is triggered only when all conditions are met.

Match content for Authentication Credential Configurations is case-sensitive. You can enter up to 50 values per field. Press Enter after each value.

Match condition reference

Create a custom business purpose policy

1. On the API Security page, go to Policy Configuration > Business Purpose.

2. Click the Custom Policy tab, then click Create Policy.

3. Configure the match conditions, then click OK.

Match content for Business Purpose is case-sensitive. You can enter up to 50 values per field. Press Enter after each value.

Match condition reference

Create an allowlist policy

1. On the API Security page, go to Policy Configuration > Configure Whitelist.

2. Click Create Policy, enter a name, and select the feature type: Risk Detection or Security Events.

3. Set match conditions based on the feature type, then select the risk or event types to ignore, and click OK.

You can add up to 10 match conditions. Match conditions for Configure Whitelist are case-sensitive. You can select multiple built-in and custom types to ignore.

Risk detection allowlist match conditions

Security event allowlist match conditions

Configure inactive API criteria

1. On the API Security page, go to Policy Configuration > Lifecycle Management.

2. Set the criteria for inactive APIs, then click OK.

   • Built-in model: An API is considered inactive if it has not been accessed or its access volume has dropped significantly over the past 8 days.

   • Custom: Set the daily access volume threshold and duration (up to 31 days). An API is considered inactive if its daily access count stays below the specified value for the entire duration.

Prerequisites

Before you begin, make sure you have:

• Enabled the service-linked role for WAF (skip this step if you already granted this authorization when enabling Simple Log Service for WAF). For details, see Service-linked Role.

• Created a Project and Logstore in the Simple Log Service console to receive the logs.

The log subscription feature does not support Logstores automatically created by SLS or Logstores named waf-logstore, wafng-logstore, or wafnew-logstore.

Configure a log subscription task

1. On the API Security page, go to Policy Configuration > Log Subscription.

2. Select the log type, then click Configure.

3. Select the Region, Project name, and Logstore name, then click OK. After configuration, logs are delivered to the Logstore when trigger conditions are met. To query and analyze logs in SLS, enable indexing as prompted. For details, see Create indexes.

4. To disable a log subscription task and avoid ongoing Logstore charges, disable the task on the Log Subscription tab and delete the corresponding Logstore. For details, see How do I disable Simple Log Service or stop billing?.

Log trigger conditions and fields

Log field value reference

Use this reference when analyzing logs or correlating field values with the WAF console display.