Knowledge Base
Frequently Asked Questions, Answered.
Got a question? Search below or browse by product category.
AppTrana WAF — Frequently Asked Questions
No questions match your search.
How can you subscribe to WAF Premium without the manual application testing?
You can contact our sales team for customized licenses.
Do we offer SaaS mode of WAF for AWS, or is it AMI only?
We offer only the SaaS model of WAF.
How do you add multiple sites into AppTrana Advanced scanning?
Each URL needs a separate license.
Does our WAF provide Regex-based rule matching protection?
You can request custom rules for your site's protection.
How to create a custom rule — are they available on the online tool?
For custom rules, you need to contact our team. We test the rule and then deliver it to you.
Does Indusface WAF provide multi-user access?
Yes, we have multiple user roles in our platform.
Do our security services use AWS WAF and Shield?
No, AppTrana is our proprietary product.
Do we conduct load/capacity testing of web applications?
No, we do not conduct load testing for any application.
What is the difference between blocked and logged attacks?
Blocked attacks are stopped by the WAF before reaching your application. Logged attacks are only recorded — they are not blocked.
Does Indusface have SIEM tools?
Yes, we have SIEM tools.
What IP range does our WAF use?
Please reach out to support@indusface.com for the current IP range list.
What version of the OWASP rule set is followed by our WAF?
We follow the latest OWASP 2021 rule set.
Can AppTrana be used for Java stack technology?
AppTrana can be used irrespective of the underlying application technology.
What is needed to start with the Advance or Premium plans — is it only a DNS change?
No code changes are required. A DNS change is all you need — update it and you're up and running.
Who creates the custom policies in WAF?
Our support team creates them after evaluating your application requirements.
How does our WAF handle Let's Encrypt SSL certificates?
You can configure either your custom SSL certificate or use our free SSL certificate.
What is the default file upload limit for different WAF gateways?
You can customize the file upload limit to meet your application's requirements.
Can we integrate Indusface WAF with SIEM?
Yes, AppTrana supports SIEM integration.
Do you provide logging and reporting?
Yes, we provide comprehensive logging and reporting capabilities.
Are there limitations on ports used by the site?
Custom rules are application-specific and are designed after evaluating your application.
Web Application Scanning (WAS) — Frequently Asked Questions
No questions match your search.
Can you do a security audit of our web application?
Yes, you can.
Do we provide source code audit scans as a service (SAST/DAST)?
We provide DAST (Dynamic Application Security Testing).
I'm looking for white-box testing including manual and automated testing based on OWASP — how do you price your services?
Please reach out to sales@indusface.com for detailed pricing information.
Do we carry out PCI DSS ASV scans?
Yes, we do.
What is the pricing of web application scanning? Is it outside only or also internal server scanning?
We do application scanning as well as server scanning for that application.
If there are no URLs on the panel for a month or more, what is the cost?
Charges are based on FQDN (Fully Qualified Domain Name) per month.
Can a website on the Advanced plan be brought down to the Basic plan?
Yes, you can downgrade your plan.
Are you only involved with testing, not prevention?
For application security "prevention" capabilities, you can add AppTrana WAAP to your subscription.
What is the philosophy behind continual testing if my environment rarely changes?
Vulnerabilities are discovered daily due to OS or third-party service updates. Even if your application doesn't change frequently, continuous scanning is required to catch newly discovered vulnerabilities.
Will your products slow website traffic while scanning?
No, it will not. We also provide configuration to scan outside business hours.
Can you do authenticated web app scanning past a login page?
Yes, we can provide authenticated scans.
Is there a way to stop or pause the scanning?
Yes, you can pause or stop a scan at any time.
Are you a VAPT testing provider?
Yes, we are a VAPT testing provider.
Do you perform penetration testing for web apps? Is it automated black-box testing?
Penetration testing is performed by our manual pentesting team — it is not purely automated.
Do you provide an API service to scan for web application security?
Yes, API security scanning is provided.
Is there a way to exclude specific URI scanning?
Yes, you can whitelist any specific URL that you would not like to scan.
Do you provide malware removal services?
No, we do not provide malware removal. We scan for malware and alert you when it is detected.
Do you have an on-premise web application vulnerability scanner?
We do not support on-premise scanning.
Are business logic vulnerabilities detected by your tools?
Our scanner is a DAST scanner, so any vulnerability that can be observed externally will be detected.
What is the number of block rules offered in WAS?
WAS does not offer blocking capabilities — that is the role of AppTrana WAAP.
What is FQDN?
FQDN stands for Fully Qualified Domain Name — e.g. app.yourcompany.com.
Do you provide web application level public IP based pentesting?
We provide web application level pentesting.
Do you have Red Team tools for website protection?
Yes, we provide 24×7 protection to applications through AppTrana.
Can you provide details for the manual penetration testing available with Total Application Security?
Please reach out to sales@indusface.com for detailed information.
SSL Certificates — Frequently Asked Questions
No questions match your search.
What brands of SSL Certificates does Indusface sell?
Entrust.
Is there documentation on SSL offloading?
Yes, we support it. Please refer to the Entrust whitepaper on SSL certificates for details on offloading.
Do you have the EV code signing certificate? What is the pricing?
Yes. Rs. 30,000 for 1 year and Rs. 60,000 for 2 years.
What about wildcard subdomain support?
Wildcard SSL certificates use the * extension and allow you to encrypt unlimited subdomains under a single certificate.
Which certificate supports 4096-bit encryption?
All Entrust SSL certificates support 4096-bit encryption.
Do you provide SSL RSA + ECC Algorithm certificates?
Yes. Except the Standard SSL certificate, all Entrust SSL certificates support both RSA and ECC algorithms.
Mobile Application Security (MAS) — Frequently Asked Questions
No questions match your search.
Are you looking for an OWASP audit for mobile apps?
We support testing across multiple platforms including iOS, Android, Windows, Symbian, and BlackBerry OS.
How do you scan a mobile app?
Indusface MAS (Mobile Application Scanner) provides a complete security assessment using a combination of automated tools, custom scripts, and manual security testing techniques.
Is your tool applicable just for websites, or do you also test Android apps?
Multiple platforms are covered including Android, iOS, Windows, and more.
Is there any place to scan mobile application vulnerabilities online?
You will need to contact us and our team will guide you through the audit process.
Can you scan your mobile app online with your site?
You will need to contact us directly — our team will guide you through the audit process.
Still Have Questions?
Our Experts Are Ready to Help
Can't find the answer you're looking for? Talk to our security team and get a personalised response.