Web Application Firewall:Core protection rules and rule groups

Create a custom rule group

You can create a custom rule group from scratch or from a default rule group.

1. Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance. You can select Chinese Mainland or Outside Chinese Mainland.

2. In the left-side navigation pane, choose Protection Configuration > Core Web Protection.

3. In the Core Protection Rule section, click Rule Groups.

4. On the Rule Groups page, click Create Rule Group.

5. In the Configure Basic Information Of Rule Group step, configure the parameters and click Next.

   Important

   After a custom rule group is created, you cannot modify the Basic Information About The Rule Group.

   Parameter	Description
   Rule Group Name	Specify a name for the rule group. The name of the rule can contain letters, digits, periods (.), underscores (_), and hyphens (-).
   Select Protection Template	Select a protection template for the rule group. Valid values: Create From Scratch: No template is specified. You must manually add rules. Important If you select this option, Automatic Update is turned off and cannot be turned on. Use Default Rule Group: You can select a default rule group, including Loose Rule Group, Medium Rule Group, and Strict Rule Group.
   Automatic Update	If you enable this feature, rules that are added to or removed from the selected default rule group are automatically synchronized to the current custom rule group. Important After the custom rule group is created, you cannot enable or disable this feature. You can enable or disable this switch only when Rule Template is set to Default Rule Group.

6. In the Configure Protection Rules step, click Add Rule. In the Add Rule dialog box, select the rules that you want to add to the rule group. You can enter a Rule ID or CVE ID to search for a rule. You can also configure the Risk Level, Protection Rule Type, and Application Type parameters to search for a rule. Then, click Add. You can also click Add All.

   Note

   • If you select Use Default Rule Group for Select Protection Template in Step 5 and the rules you want to add are included in the rule library, you can skip this step.

   • Rules in the rule list are sorted in descending order based on update time.

   If you want to remove a rule after it is added, you can enter the Rule ID or CVE ID of the rule in the rule list to search for the rule. You can also configure the Risk Level, Protection Rule Type, and Application Type parameters to search for the rule. Then, select the rule and click Remove. You can also click Clear All.

7. Click Next. In the Complete step, click Complete.

   After you create a rule group, you can perform the following operations on the rule group in the rule group list:

   • Click the number in the Number Of Built-in Rules column to view the built-in rules of the rule group.

   • Click Edit, Copy, or Delete in the Actions column to modify, copy, or delete the rule group.

     Note

     • You cannot modify the basic information about a rule group.

     • By default, the name of a copied rule group is in the "original rule group name-copy" format. A copied rule group is not associated with protected objects.

     • You cannot delete a rule group that is associated with a protection template. If you want to delete the rule group, you must first dissociate it from the core protection rule.

Create a custom protection template

1. In the left-side navigation pane, choose Protection Configuration > Core Web Protection.

2. In the Core Web Protection page, scroll down to the Core Protection Rule section and click Create Template.

   Note

   If this is your first time to create a core protection rule template, you can also click Configure Now in the Core Protection Rule card in the upper part of the Core Web Protection page.

3. In the Create Template - Core Protection Rule panel, configure the parameters and click OK.

   Note

   By default, the protection template is enabled.

   Parameter	Description
   Template Information	Template Name: Enter a name for the template. The name of the rule can contain letters, digits, periods (.), underscores (_), and hyphens (-). Save As Default Template: Specify whether to set this template as the default template for the protection module. You can specify only one default template for a protection module. If you set a default template, you do not need to configure the Apply To parameter. The default template is automatically applied to all protected objects and protected object groups that are not associated with custom protection templates (including newly added objects and objects removed from custom protection templates). You can also manually remove them from the default template.
   Rule Configuration	Action: Select the action that you want WAF to perform when a request matches the rule. Valid values: Block: blocks a request that matches the rule and returns a block page to the client that initiates the request. Note By default, WAF returns a preconfigured block page. You can use the custom response feature to configure a custom block page. Monitor: records a request that matches the rule in a log and does not block the request. You can query the logs of requests that match the rule and analyze the protection performance. For example, you can query logs to check whether normal requests are blocked. Important You can query logs only if the Simple Log Service for WAF feature is enabled. If you select Monitor, you can perform a dry run on the rule to check whether the rule blocks normal requests. If the rule passes the dry run, you can set the Action parameter to Block. Note On the Security Reports page, you can query the details of matched rules in Monitor or Block mode. For more information, see Security reports. Rule Group Type: Select the type of rule group that you want to associate with the core protection rule and select the corresponding rule group. Valid values: Default: If you select this option, the template is associated with a default rule group. You can select Loose Rule Group, Medium Rule Group, or Strict Rule Group. Custom: If you select this option, you must select a custom rule group from the drop-down list. For more information about how to create a rule group, see Create a custom rule group.
   Semantic Engine	By default, Semantic Engine is enabled to defend against SQL injection attacks. For non-injection attacks, Semantic Engine provides the Complete SQL Statement Detection switch to enable or disable this detection. Note The following list describes the difference between incomplete SQL statements and complete SQL statements: Incomplete SQL statements: Requests contain SQL fragments that can be concatenated by backend services to form complete SQL statements, such as /query.php?name='and 1=1%23. Complete SQL statements: Requests contain complete SQL statements, such as /query.php?sql=select name from users where 1=1%23. Semantic Engine supports the following configurations: Action: Select the action that you want WAF to perform when a request matches the rule. Valid values: Block: blocks a request that matches the rule and returns a block page to the client that initiates the request. Note By default, WAF returns a preconfigured block page. You can use the custom response feature to configure a custom block page. Monitor: records a request that matches the rule in a log and does not block the request. You can query the logs of requests that match the rule and analyze the protection performance. For example, you can query logs to check whether normal requests are blocked. Important You can query logs only if the Simple Log Service for WAF feature is enabled. If you select Monitor, you can perform a dry run on the rule to check whether the rule blocks normal requests. If the rule passes the dry run, you can set the Action parameter to Block. Note On the Security Reports page, you can query the details of matched rules in Monitor or Block mode. For more information, see Security reports. Complete SQL Statement Detection (enabled by default) If WAF detects non-injection attacks, such as complete SQL statements (for example, /query.php?sql=select name from users where 1=1%23), WAF performs the specified action on the requests. Note If tools such as phpMyAdmin or Adminer are used to analyze your business data, we recommend that you disable this detection.
   Protocol Compliance	Different programming languages have different levels of format processing requirements for HTTP requests. This may cause vulnerabilities that can be exploited to bypass WAF, such as file uploads. The protocol compliance feature checks whether HTTP requests use the correct formats at the protocol layer to prevent vulnerabilities and attacks. The protocol compliance feature is supported only for pay-as-you-go WAF instances and subscription WAF instances that run the Enterprise or Ultimate edition.
   Intelligent O&M	After you turn on Intelligent Whitelist, WAF performs intelligent learning based on historical service traffic and identifies protection rules that may cause false positives. Then, WAF adds the URLs that are incorrectly blocked to the intelligent whitelist. This prevents normal requests from being blocked. Protection rules of the whitelist module are automatically created. You can view the protection rules in the AutoTemplate protection template in the Whitelist section. For more information, see View whitelist rules. Note The intelligent whitelist feature is supported only for pay-as-you-go WAF instances and subscription WAF instances that run the Enterprise or Ultimate edition.
   Apply To	Select items to which you want to apply the template on the Protected Objects and Protected Object Groups tabs. For more information, see Configure protected objects and protected object groups. A protected object or protected object group can be associated with only one core protection rule template. If you set a default protection template, all protected objects and protected object groups that are not associated with custom protection templates are selected by default. If you do not set a default template, no protected objects or protected object groups are selected by default. You can manually modify the objects to which the template applies.

   By default, a newly created protection template is enabled. You can perform the following operations on the template in the template list:

   • View the numbers of protected objects and protected object groups that are associated with the template in the Protected Object/Group column.

   • Turn on or turn off the switch in the Status column to enable or disable the template.

   • Click Create Rule in the Actions column to create a protection rule for the template.

   • Click Edit, Delete, or Copy in the Actions column to manage the template.

   • Click the icon to the left of the template name to view the protection rules in the template.

   • If you turned on Intelligent Whitelist when you created the core protection template (the icon is displayed next to the protection rule), you can click Delivery Record in the Actions column to view the intelligent whitelist delivery records. If you did not turn on Intelligent Whitelist (the icon is displayed next to the protection template), you can directly turn on or turn off the Intelligent Whitelist switch in the template list.

   You can also click Rule Groups in the Core Protection Rule section to view the association between rule groups and protection templates.

What to do next

On the Core Protection Rule tab of the Security Reports page, you can view the hit records of specific protection rules. For example, you can click View Details for a specific Rule ID in the attack event record area to learn about the attack details that match the rule. For more information, see Security Reports.

References

• For more information about the protection objects, protection modules, and protection process of WAF 3.0, see Protection configuration overview.

• For more information about how to create a protection template by calling an API operation, see CreateDefenseTemplate.

• For more information about how to create a core protection rule and configure the rule content, see CreateDefenseRule.