WAF profiles

web application firewall (WAF) filters and blocks malicious traffic directed to your web apps and websites. It protects against common attacks such as SQL injections, XSS, web vulnerabilities, and prevents data breaches and service outages.

WAF analyzes a web app's incoming HTTP requests according to pre-configured rules. Based on the analysis results, certain actions are applied to HTTP requests: the request can be allowed, blocked, or forwarded to SmartCaptcha.

Rules for analyzing requests are configured in a WAF profile. A WAF profile is attached to a security profile as a separate WAF rule.

For more information about connecting to a security profile, see this section.

The following settings are available in the WAF profile:

• Rule sets
• Exclusion rules

Rule setsRule sets

A WAF profile supports the following rule sets: ML WAF (Yandex Malicious Score), Yandex Ruleset, OWASP Core Rule Set.

For the full list and description of the rules included in each rule set, see the section dedicated to configuring a rule set in the management console.

ML WAF (Yandex Malicious Score)ML WAF (Yandex Malicious Score)

This rule set was developed by Yandex using machine learning (ML) algorithms. ML WAF detects and blocks attacks that evade the signature-based method. The rules automatically adjust to new attack tactics. By default, only the Malicious attacks rule group is enabled. To extend ML WAF coverage to other attack groups, enable them separately.

We recommend using this rule set in addition to the OWASP or Yandex Ruleset.

How to set up:

• Each rule has its own anomaly threshold. Requests exceeding this threshold are blocked. The recommended initial value is 90.
• The paranoia level is not used.

Yandex RulesetYandex Ruleset

Yandex developed this rule set based on real-world experience of protecting company services. It includes rules to detect known attack patterns (signatures), such as code injections (SQLi, XSS), CVE vulnerabilities, and remote code execution. The rule set is continuously updated to protect against new threats as they emerge.

Yandex Ruleset is divided into individual rule groups that you can manage separately:

• Attack XSS. Detects cross-site scripting (XSS), i.e., injection of malicious JavaScript code through server-side vulnerabilities (reflected and stored XSS), e.g., injections in HTTP request parameters or script injection into UI elements.
• Attack SQLI. Detects SQL injections, i.e., malicious SQL code fragments in HTTP request parameters used to manipulate SQL databases.
• Attack LFI. Blocks local file inclusion (LFI) attempts aimed at unauthorized reading or execution of local server files via path traversal vulnerabilities (e.g., using ../ or absolute paths).
• Attack RFI. Blocks remote file inclusion (RFI) aimed at executing malicious code from external resources by injecting URLs into file inclusion parameters (e.g., include, require).
• Attack Tool. Detects activity from automated tools: vulnerability scanners, exploit frameworks, brute-force utilities, and other software used for penetration testing and attacks (based on User-Agent signatures and request patterns).
• Attack RCE. Protects against remote code execution (RCE) and prevents running server OS commands via vulnerable parameters (e.g., system call injections).

How to set up:

• Rule groups can be turned on and off independently of each other.
• Each rule group gets its own anomaly threshold and action if this threshold is exceeded.
• Rules within a group can be filtered by type: basic rules or rules related to CVE vulnerabilities.
• The paranoia level is not used.

Available versionsAvailable versions

Version 0.1.1Version 0.1.1

This rule set contains 129 rules created in collaboration with SolidSoft, developers of the SolidWall WAF intelligent firewall. This version offers superior attack prevention and threat detection compared to the previous release.

Key changes:

• Added 40 new rules, including 34 rules for detecting critical CVEs in popular technologies and products, such as Bitrix, Log4j, React, and PostgreSQL.
• Extended coverage of LFI, RCE, and SQLi attacks.
• Revised some of the version 0.1.0 rules to reduce the false positive rate.

Version 0.1.0Version 0.1.0

The first Yandex Ruleset version contains 90 rules for detecting basic types of attacks.

OWASP Core Rule SetOWASP Core Rule Set

The set was developed by the Open Worldwide Application Security Project (OWASP) to ensure protection against vulnerabilities listed in the OWASP TOP‑10. The OWASP Core Rule Set consists of rules aimed to detect malicious actions, including malicious file uploads, potential SQL injection attacks, DoS attempts, code injection attempts, and many more. For more information, see this OWASP Core Rule Set repository on GitHub.

How to set up:

• You set a common anomaly threshold for the whole rule set. If the threshold is exceeded, the request gets blocked.
• You set a paranoia level for the whole rule set.
• Rules are organized into groups (Method Enforcement, Scanner Detection, Protocol Enforcement, etc.). For each rule, an anomaly value and a blocking rule attribute are specified.

Available versionsAvailable versions

OWASP Core Rule Set versions 4.0.0 and 4.8.0 are available in Smart Web Security.

Rule settingsRule settings

You can add one or multiple rule sets to a WAF profile. When adding multiple rule sets, remember to configure the following:

• Priority: Sequence of rule sets employed to determine the final verdict.
• Profile trigger condition: Whether a request must be identified as a threat by all added rule sets or by at least one of them.

When configuring rule sets, you can select specific rules for request checking and customize their triggering parameters. Each rule has an anomaly value and a paranoia level assigned.

AnomalyAnomaly

Each rule from the set is assigned a numeric anomaly value, i.e., a potential attack indicator. The higher this value, the more likely it is that the request that satisfies this rule is in fact an attack.

Anomaly threshold is the total anomaly score of triggered rules that results in blocking the request. The anomaly threshold level depends on the rule set:

• In the OWASP Core Rule Set, you specify a threshold for the whole rule set. The possible values range ​​from 2 to 10 000. We recommend that you start with a threshold of 25 and gradually reduce it to 5.
• In Yandex Ruleset, you specify a threshold individually for each rule group. The recommend value is 7.
• In ML WAF, you specify a threshold individually for each rule. The recommended initial value is 90.

To reduce the anomaly threshold, address WAF false positives triggered by legitimate requests. To do so, select rules from the basic set and configure exclusion rules. Additionally, use the Only logging mode in your security profile to test different anomaly thresholds.

You can configure any rule in the set to be a blocking one. Requests matching such a rule get blocked regardless of the anomaly threshold you set. If the Only logging mode is enabled in the security profile, requests will not be blocked even when if they match the blocking rules.

Paranoia levelParanoia level

The paranoia level is an OWASP-specific feature that classifies rules based on how aggressive they are. The higher the paranoia level, the better the protection, but also the greater the risk of WAF false positives.

In the basic rule set settings, you can configure the overall paranoia level and thus quickly engage a collection of rules with this or lower paranoia level.

Exclusion rulesExclusion rules

An exclusion rule disables WAF rules for requests that satisfy the specified conditions. Use exclusion rules to prevent false positives triggered by legitimate traffic.

An exclusion rule offer these blocks of settings:

• Logging.

• Skip checks: Which WAF rules to cover by the exclusion – all or selected ones.

• Scope: Which part of the request to exclude when applying WAF rules:

  • Whole request.
  • Individual request parameters: HTTP body, Cookie, HTTP header, or Query params.

• Traffic conditions: Which requests are subject to the exclusion. If you set several conditions of different types, the exclusion will apply only if all conditions are met at the same time. If no conditions are set, the exclusion will apply to all traffic.

WAF setup recommendationsWAF setup recommendations

The WAF profile is set up individually for each web service. Before you enable protection, test your OWASP rules in Only logging mode for at least one week. ML WAF and Yandex Ruleset require a shorter testing period because they are adapted for Russian traffic. At this stage, false positives are a possibility; this is a part of training WAF to process your traffic. Scan the logs for false positives and adjust the rules as needed. For example, if the rule with id920280 gets triggered incorrectly when using HTTP/2, you can disable it immediately. This rule will work correctly with HTTP/1.1.

Once WAF is in production mode, use logs and monitoring charts at regular intervals to check how your rules perform. This will allow you to track anomalies and adjust the protection specifically for your web app.

Useful linksUseful links

• Create and connect a WAF profile
• Setting up basic protection in Smart Web Security