Self-Managed Rules – AppTrana Feature Update Overview
Introducing Self-Managed Rules, a new addition to our fully managed security suite!
AppTrana empowers you to take control, allowing you to create, view, and manage the custom rules All By YOURSELF!
What are WAF Rules?
WAF rules set the guidelines for how the Web Application Firewall responds when it identifies a match between incoming web traffic and the conditions specified in the security rules.
These settings formalize the enforcement criteria, enabling organizations to define the appropriate responses and mitigation measures for various security threats or vulnerabilities.
AppTrana security rules include two types of rules:
- Predefined Rules – a set of preconfigured rules designed to address common web applications and API security threats and vulnerabilities.
- Custom Rules – The managed security team can set custom rules to tailor the WAF’s protection to the organization’s unique application and security needs.
Here is a detailed blog on how WAF security rules can detect and block known attack patterns
AppTrana WAAP stands out as a unique turn-key solution due to its comprehensive set of predefined rules. These rules are crafted based on blocklists, known signatures, and IP reputation lists such as HoneyPot Project and spamhaus DB.
Our managed security team ensures regular updates, keeping the rules dynamically adaptive to combat the latest threats.
AppTrana’s custom WAF rules go beyond standard configurations, offering advanced settings for precise control and manipulation of application traffic. With the support of AppTrana’s round-the-clock managed team, organizations can create custom rules tailored to their environment.
Our security experts’ specialized knowledge ensures that the rules effectively mitigate threats, minimize false positives, and deliver optimal protection for web applications.
Latest Feature: Self-Managed Rules
Nobody understands your web application better than you do. Our self-managed rules acknowledge this by allowing you to develop custom rules in the self-service mode that align perfectly with your application’s unique architecture, functionality, and business logic.
By enabling you to take charge, you no longer have to rely on our managed security team for rule creation and configuration.
Note: Adding this feature doesn’t take away the managed services support by Indusface. But, the feature is just an add-on to the overall product offering.
Here is a brief demo of the self-managed rules feature – a quick walkthrough:
To access this feature, visit the Settings > WAF tab > Custom Rule Categories > Create Custom Rules
Create Custom Rules includes 3 steps:
Step 1: Rule Basic Details
The rule’s basic information is captured in this section.
|Rule Name||Allows you to provide a descriptive name for your rule|
|Description||It enables you to provide a comprehensive description of the rule’s characteristics|
|Fail-Safe Range||The fail-safe range of the rule in percentage value is given here. The ‘Fail-safe range’ ensures that any rule added by a user does not disrupt behaviour of WAF in the event of rules being wrongly created.
This is achieved by moving the rules to ‘log-only’ mode when the % of requests blocked by WAF exceeds the expected % of rules to be blocked.
|Rule Coverage||Allows you to specify the applications to which the rule will be applied|
Step 2: Rule Trigger Condition
The rule trigger condition refers to the criteria or set of conditions that need to be met for a rule to be triggered or activated within an application.
By defining rule trigger conditions, you can specify the circumstances under which the rule’s actions or protections should be applied.
The section includes three unique criteria categories:
- Geo Block/Allow Criteria
- IP Block/Allow Criteria
- Custom Rule
GEO Block/Allow Criteria
The Geo Block/Allow Criteria condition allows you to implement rules based on the geographic location of incoming traffic. You can selectively block or allow access to your web application based on country/countries.
In this criterion, you can select from two different conditions to apply:
- Block req. from selected countries
- Allow req. ONLY from the selected countries (block all other countries)
Geo Block/Allow Criteria Use Case
Suppose you have an e-commerce website that operates globally but wants to restrict access to certain countries due to regulatory requirements or security concerns. You can create a custom rule using the Geo Block/Allow Criteria in this scenario.
Condition: Block requests from selected countries
You can select specific countries you want to block access from. For instance, you may choose to block access from countries known for high rates of fraudulent activities or unauthorized access attempts. Once the rule is applied, any incoming traffic originating from those selected countries will be blocked, preventing potential security breaches.
IP Block/ Allow Criteria
This criterion enables users to define rules for IP addresses, granting them the flexibility to allow, block, or whitelist specific IPs.
Within the IP Block/Allow Criteria, you will find three distinct conditions to choose from:
- Allow req. ONLY from the selected IP addresses (block all others)
- Block all req. from selected IP addresses
- Whitelist selected IP addresses
IP Block/Allow Criteria Use Case
Suppose you have identified a suspicious IP address that is repeatedly attempting unauthorized access to your web application. To enhance the security of your system, you can leverage the IP Block/Allow Criteria to create a custom rule.
Condition: Block all requests from selected IP addresses
You can specify the suspicious IP address in the rule configuration and set the rule condition to block all requests from the selected IP address. Once the rule is applied, any traffic originating from that particular IP address will be blocked, preventing further unauthorized access attempts.
Within the Custom Rule criterion, users can define rules for multiple parameters, including URI, User Agent, HTTP Method, HTTP Referrer, and ARGS.
Each parameter has its own set of rule actions that users can choose from.
|URI||URI starts with, does not start with, ends with, does not end with, contains, does not contain, equals, and does not equal|
|User Agent||Starts with, Does not Equals to|
|HTTP Method||URI starts with, does not start with, ends with, does not end with, contains, does not contain, equals, and does not equals to|
|HTTP Referrer||Equals to, Does not Equals to|
|ARGS||Starts with, Ends with, Contains, Equals to|
Step 3: Rule Action
This section is exclusive to the Custom Rule Criteria category.
Rule action refers to the predefined response or operation that is associated with a particular rule. It outlines the action to be taken when the rule conditions are met.
Actions for rules with conditions URI, USER AGENT, HTTP METHODS, HTTP REFERRER:
- Whitelist Request and Log
- Skip Rule Category (Whitelist Rule) and Log
- Skip Rule and Log
- Log only
- Block Request and Log
Custom Rule Use Case
Custom Rule to Avoid Cookie Validation to Reduce False Positive
In some instances, strict cookie validation may lead to false positives, causing legitimate user requests to be flagged as suspicious. To prevent such false positives while still maintaining security, you can create a custom rule with appropriate configurations using the Custom Rule criteria.
Instead of blocking requests that fail cookie validation, you can configure the rule to allow those requests to proceed. By setting the rule action to “Allow,” you ensure that legitimate users are not denied access or interrupted by false positive detections.
- Request Parameter: ARGS
- Comparing Value: false cookie
- Rule Action: Skip Rule for Selected ARG
To whitelist specific rules, you can access the Whitelisted Rules field drop-down menu, select the desired rules, and then click the Create button. This allows you to define exceptions for certain arguments and ensure that the associated rules are skipped during the validation.
Take control, create custom rules that align perfectly with your unique application requirements, and upgrade your defense to new heights. To know more about the feature in detail, contact us.