Web Application Firewall:Domain asset center

Overview

As your business grows, unauthorized sites or unreclaimed test environments can accumulate unmanaged "zombie" assets. These often run outdated components and become attack vectors that bypass perimeter defenses and compromise internal networks. To address this risk, WAF provides global asset identification:

• Comprehensive discovery and mapping: By correlating configurations from Alibaba Cloud domain services, DNS resolution, and SSL certificates, WAF discovers domain resources both on and off Alibaba Cloud (including non-Alibaba Cloud providers and on-premises data centers), eliminating blind spots from siloed protection. Combined with active probing and passive analysis, it accurately identifies middleware and development frameworks to manage supply chain security risks.

• Risk assessment and protection onboarding: By combining traffic analysis with the latest threat intelligence, WAF evaluates domain risk levels and calculates security scores. This helps you quickly identify high-risk targets, set protection priorities, and enable protection promptly to prevent domain compromise.

Enable asset center

1. Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.

2. In the left-side navigation pane, click Onboarding. On the CNAME Record tab, click Asset Center on the right.

3. On the Asset Center page, click Enable Now. For pay-as-you-go WAF instances, enabling this feature incurs additional charges. For pricing details, see Billing details.

4. When you enable Asset Center for the first time, WAF automatically creates the service-linked role AliyunServiceRoleForWAF to access resources in other cloud services. You can view this role on the Roles page in the RAM console.

5. After authorization is complete, WAF automatically detects domain assets under the current Alibaba Cloud account and displays the results in the Asset Center.

6. To improve detection accuracy, we recommend that you enable Active Fingerprint Scanning in the upper-right corner. After you enable this feature, WAF identifies fingerprint information for connected assets by combining passive traffic learning with active probing. Active scans run every two weeks. We recommend that you keep this feature enabled.

Add an asset

If a root domain you want to monitor does not appear in the asset list, you can manually add it.

1. On the Asset Center page, go to the Overview tab and click Add Asset.

2. In the Add Asset dialog box, enter the domain name and complete the ownership verification.

   • DNS validation (recommended): Manually add the TXT record provided by WAF at your domain's DNS provider.

   • File validation: Upload the verification file provided by WAF to a specified root directory on your origin server. You must have permission to access the origin server and configure a security group policy that allows access from all IP addresses. This ensures that WAF can access the verification file from the internet.

   DNS validation

   1. In the verification prompt area, click the Method 1: DNS Record tab.

   2. At your DNS provider, add a TXT record by using the Record Type, Hostname, and Record Value provided in the WAF console.

      If you use Alibaba Cloud DNS, follow these steps. If you use a different DNS provider, follow the procedures for their system.

      1. On the Public Zone page, find the target primary domain name and click Settings in the Actions column.

      2. Click Add Record, configure the following parameters, and then click OK. You can leave other parameters at their default values.

         • Record Type: Select TXT.

         • Hostname: Copy and enter the prefix of the domain name. Example: verification.

         • Record Value: Copy and enter the record value that WAF generated. Example: verify_8fca29dec226****.

   3. Wait for the TXT record to take effect. A new TXT record takes effect immediately. If you modify an existing TXT record, the modification typically takes about 10 minutes to take effect. The exact time depends on the TTL (Time to Live) that is configured in your domain's DNS settings. The default TTL is 10 minutes.

   4. Return to the WAF console and click Verify.

      • If Verification successful is displayed, your domain ownership is verified.

      • If Verification failed is displayed, perform the following steps to troubleshoot the issue:

        1. Check the TXT record: Ensure the hostname and record value match the information in the WAF console. If they do not match, delete the incorrect record, add the record again, and then run the verification again.

        2. Wait for the DNS record to take effect: A DNS record may not take effect immediately after it is configured. The time it takes for the record to take effect depends on the TTL set on the domain name server. Wait 10 minutes and then verify again.

        3. Change the verification method: If the verification fails multiple times, we recommend that you use Method 2: File Validation.

   File validation

   1. In the verification prompt area, click the Method 2: Verification File tab.

   2. Click the link to download the verification file.

      Important

      • The verification file is valid for three days after you download it. If you do not complete the file validation within this period, you must download the file again.

      • Do not modify the verification file. For example, do not edit or rename the file.

      • WAF accesses the origin server based on the protocol type that you select. Ensure your origin server's security group or firewall rules allow the corresponding traffic:

        • If you select HTTP, allow inbound TCP traffic on port 80 from 0.0.0.0/0.

        • If you select HTTPS, allow inbound TCP traffic on port 443 from 0.0.0.0/0.

   3. Upload the verification file to the root directory of your website on the origin server. The origin server can be an ECS (Elastic Compute Service) instance, an OSS (Object Storage Service) bucket, a CVM (Cloud Virtual Machine) instance, a COS (Cloud Object Storage) bucket, or an EC2 (Elastic Compute Cloud) instance.

      Note

      If you add a wildcard domain name such as *.aliyun.com, you must upload the verification file to the root directory of aliyun.com.

      • Default root directory of an Nginx server: /usr/share/nginx/html

      • Default root directory of an IIS server: C:\inetpub\wwwroot

   4. Return to the WAF console and click Verify.

      • If Verification successful is displayed, your domain ownership is verified.

      • If Verification failed is displayed, troubleshoot the issue based on the error message:

        Problem	Solution
        Cannot access the domain name	Check the DNS resolution of the domain name to make sure that a DNS record points to the origin server. For Alibaba Cloud DNS, see Add a DNS record. Check the security group or firewall rules of the origin server to make sure that requests from the internet are allowed. For ECS security groups, see Add a security group rule.
        Verification file does not exist	Upload the verification file to the origin server again.
        Incorrect file content	On your domain's origin server, delete the incorrect verification file. Upload the verification file again.

   5. A security group rule that allows access from all IP addresses (0.0.0.0/0) poses a security risk. After the ownership is verified, we recommend that you remove the temporary rule for 0.0.0.0/0 to maintain your server's security.

3. After completing the configuration, click Add. Manually added assets appear in the Asset Center list the following day (T+1).

View asset details

On the Asset Center page, you can view the following details for your domain assets:

• Overview: Located at the top of the page, this section displays domain asset statistics for the current Alibaba Cloud account, including Second-level Domain Names, Subdomains, and Unprotected Subdomains (subdivided into high, medium, and low risk levels).

• Root domain overview: Located in the list area at the bottom of the page, this section displays the Second-level Domain Name along with its IP Address, the number of subdomains protected by WAF, and the number of subdomains not yet protected by WAF. You can enter keywords in the search box above the list to query a specific root domain.

• Domain details: Click the icon to the left of a root domain to view its subdomain list. You can also filter subdomains using the search box. Each subdomain entry includes:

  • IP Address: The IP address or CNAME address that the domain resolves to.

  • Fingerprint: The website server fingerprint information, identified through passive traffic analysis and active fingerprint scanning. To view this information, ensure that Active Fingerprint Scanning is enabled in the upper-right corner.

  • Severity: The cloud risk level of the domain, assessed based on attack trends and threat intelligence data from the last 30 days.

  • Status: Indicates whether the domain is protected by WAF. To enable protection, see Add a domain to WAF via CNAME.

  • Details: Specific threat events and information records for the subdomain.

Download asset details

1. On the Asset Center page, go to the Overview tab, select the root domains to export, and click the icon in the upper-right corner.

2. Go to the Export Record tab, and click Download in the Actions column for the target file.

Limitations

• Details: Available only for pay-as-you-go, subscription Enterprise Edition, and Flagship Edition WAF instances.

• Asset download: Available only for subscription Enterprise Edition and Flagship Edition WAF instances, and you must use an Alibaba Cloud primary account.