Getting started with Yandex Smart Web Security

Application Load Balancer evenly distributes incoming traffic between nodes, thus preventing overload and improving fault tolerance. If you have no L7 load balancer set up yet, you can deploy a test infrastructure.

1. In the management console, select the folder the protected resources are in.

2. From the list of services, select Smart Web Security.

3. Click Create profile and select From a preset template.

   A preset profile includes:

   • Basic default rule enabled for all traffic with the Deny action type.
   • Smart Protection rule enabled for all traffic with the Full protection action type.

   Tip

   Creating a pre-configured profile with full Smart Protection is preferable. This will ensure the highest level of security for your resource being protected.

4. Enter a name for the profile, e.g., test-sp1.

5. In the Action for the default base rule field, select Deny.

6. Optionally, enable or disable the use of HTTP request information to tune machine learning models under Fine-tuning ML models.

7. Click Create.

1. Select the test-sp1 profile you created earlier.

2. Make sure the Security rules tab contains a rule with the following parameters:

   • Type: Smart Protection
   • Action: Full protection
   • Conditions: All traffic

   This rule sends all incoming traffic of the protected resource for an automatic check using ML and behavioral analysis algorithms. As a result of this check:

   • Legitimate requests are routed to the protected resource.
   • Illegitimate requests and attacks are blocked.
   • Suspicious requests are sent to SmartCaptcha for additional verification.

The connection method depends on the resource type.

• To connect a domain:

  1. Under Domain security → Domains, select the required domain.
  2. From the top menu, click Connect security profile and select an existing or create a new security profile.

• To connect a virtual host in Application Load Balancer:

  1. If the load balancer is managed by an Application Load Balancer ingress controller, use the Ingress resource annotation.

  2. If the load balancer is managed by you, select the created profile under Security profiles.

  3. At the top right, click Connect to host.

  4. In the window that opens, select:

     • Load balancer.
     • HTTP router.
     • Virtual host. You can associate the security profile with multiple virtual hosts at once.

     To associate the profile with another L7 load balancer, click Add load balancer.

  5. Click Connect.

  You will see the associated virtual host under Connected hosts.

• To connect an API gateway:

  1. Under Security profiles, copy the ID of the profile you need.
  2. When creating an API gateway or in the existing API gateway specification, set this extension: x-yc-apigateway:smartWebSecurity.
  3. Specify the copied ID in the extension.

1. In the Smart Web Security service page, select the Monitoring section on the left-hand panel.
2. View the charts of allowed and blocked requests.

1. In the management console, select the folder where you want to create a WAF profile.
2. From the list of services, select Smart Web Security.
3. Go to the WAF profiles tab and click Create WAF profile.
4. Enter a name for the profile, e.g., test-waf-profile-1.
5. By default, the WAF profile uses the OWASP Core Rule Set. To view the rules it includes, click the row with its description.
6. Click Create.

1. On the WAF profile's overview page that opens, click Set up a basic rule set.

2. Set the Anomaly threshold, which is the sum of anomaly scores of the triggered rules that will block the request, e.g., Moderate: 25 and more.

   We recommend that you start with an anomaly threshold of 25 and gradually reduce it to 5. To reduce the anomaly threshold, address WAF false positives triggered by legitimate requests. To do so, select rules from the basic set and configure exclusion rules. You can use the Only logging (dry-run) mode in the security profile to test various anomaly thresholds.

3. Set the required Paranoia level, e.g., 2 or lower.

   The paranoia level classifies rules based on how aggressive they are. The higher the paranoia level, the better the protection, but also the greater the risk of WAF false positives.

4. Check the rules you included in the set. Add or delete them as needed. When using rules, pay attention to their anomaly scores and paranoia levels.

You can configure any rule in the set to block requests. Requests matching such a rule get blocked regardless of the anomaly threshold you set. To turn a rule into a blocking one, click on its right. If the Only logging(dry-run) mode is enabled in the security profile, requests will not be blocked even when if they match the blocking rules.

1. Go to the Exclusion rules tab and click Create exception rule.

2. Enter a name for the exclusion rule, e.g., exception-rule-1.

3. Under Scope of use, specify rules from the basic set for which the exclusion will apply. You can either select All rules or specify particular rules.

4. Under Traffic conditions, select the triggering conditions for the exclusion rule.

   If you leave the Conditions field empty, the exclusion rule will apply to all traffic.

5. Click Create.

1. Navigate to the Security profiles tab.
2. From the list, select the security profile to connect your WAF profile to, e.g., test-sp1.
3. Click Add rule.
4. Enter a name for the rule, e.g., waf-rule-1.
5. In the Priority field, set a value higher than that of the Smart Protection rules already existing in the security profile, e.g., 888800.
6. Optionally, to test your WAF profile and simulate false positives triggered by legitimate requests, use the Only logging (dry-run) mode in the security profile.
7. In the Rule type field, select Web Application Firewall.
8. In the WAF profile field, select the previously created profile named test-waf-profile-1.
9. In the Action field, select Full protection.
10. If required, set the conditions for traffic mapping.
11. Click Add.

1. In the management console, select the folder where you want to create an ARL profile.
2. From the list of services, select Smart Web Security.
3. Go to the ARL profiles tab and click Create ARL profile.
4. Enter a name for the profile, e.g., test-arl-profile-1.
5. Add a profile description and labels if needed.
6. Click Create.

1. On the ARL profile's overview page that opens, click Add rule.

2. Enter a name for the rule, e.g., arl-rule-1.

3. In the Priority field, set the rule priority within the ARL profile, e.g., 1000.

4. Optionally, to test the ARL rule, enable the Only logging (dry run) mode. Requests will not be blocked in this mode.

5. Under Traffic conditions, select All traffic or On condition.

6. To set traffic conditions, select one or more items from the Conditions list:

   • IP: IP address, IP address range, IP address region, or address list.
   • HTTP header: HTTP header string.
   • Host: Domain receiving the request.
   • HTTP method: Request method.
   • Cookie: Cookie header string.

7. Under Request counting, select how to count requests for limiting:

   • No grouping: Count each request separately.
   • Grouping by property: Count the number of request groups sharing one or more properties.

   1. Select a grouping property:

      • Request path: Request path.
      • HTTP method: Request method.
      • IP address: IP address the request originates from.
      • Region: IP address region of the requests.
      • Host: Domain receiving the request.
      • HTTP cookie: String in the cookie header.
      • HTTP header: HTTP header string.
      • Query params: String in the request parameters.

   2. Optionally, enable Case-sensitive to put properties with the same values in different cases into different groups.

8. Specify the request limit and select the time interval, e.g., 1000 requests per 1 minute.

9. Click Save rule.

1. Navigate to the Security profiles tab.
2. From the list, select the security profile to connect your ARL profile to, e.g., test-sp1.
3. Click Edit.
4. In the ARL profile list, select the previously created test-arl-profile-1.
5. Click Save.