WAF profiles
Note
WAF is at the Preview stage.
To protect your web apps from external threats, Yandex Smart Web Security implements a Web Application Firewall (WAF).
WAF analyzes a web app's incoming HTTP requests according to pre-configured rules. Based on the analysis results, certain actions are applied to HTTP requests.
You can manage WAF using a WAF profile, which connects to the security profile as a separate rule.
For more information about connecting to a security profile, see Getting started with a WAF profile.
The following settings are available in the WAF profile:
Configuring request body analysis parameters will become available at a later time.
Basic rule set
The WAF profile offers a basic rule set called OWASP Core Rule Set
Other basic rule sets will become available soon.
In the basic rule set settings, you can select specific request checking rules. Each rule has an anomaly value and a paranoia level assigned.
Anomaly
Each rule from the set is assigned a numeric anomaly value, i.e., a potential attack indicator. The higher this value, the more likely it is that the request that satisfies the rule is an attack.
You can set an anomaly threshold for the whole set of rules, i.e., the sum of anomaly values of the triggered rules that will block the request. The possible threshold values are from 2
to 10,000
.
We recommend that you start with the anomaly threshold of 25
and gradually bring it down to 5
. To reduce the anomaly threshold, work on the WAF false positives triggered by legitimate requests. To do so, select rules from the basic set and configure exclusion rules. You can use the Only logging (dry-run) mode in the security profile to test various anomaly thresholds.
You can turn any rule from your set into a blocking rule. A request that satisfies such a rule will be blocked regardless of the anomaly threshold you use. If the Only logging (dry-run) mode is enabled in the security profile, requests will not be blocked even when if they satisfy the blocking rules.
Paranoia level
Paranoia level classifies rules according to their aggression. The higher the paranoia level, the better your protection, but also the higher the probability of WAF false positives.
In the basic rule set settings, you can configure the overall paranoia level and thus quickly engage a collection of rules with this or lower paranoia level.
Exclusion rules
Exclusion rules are intended to prevent WAF false positives triggered by legitimate requests.
You can configure skipping specific rules or all rules in a given set.
You can configure trigger conditions for each exclusion rule. If you use several conditions of different types, they all must be satisfied for the exclusion rule to trigger. If no conditions are specified, the exclusion rule will apply to the whole traffic.