OWASP Rules
About
When accessing the WAF management screen of the relevant vService in TR7 ASP, the OWASP TOP 10 based rule sets for the service can be viewed by clicking the OWASP Rules button. The areas where the existing rules are effective can be edited, risk scales can be adjusted. Additionally, new rules based on Regex can also be manually added on TR7 ASP.
Interface
OWASP Rules Listing Screen
- 1 (Information to be Displayed in the Table)
In the table where the list of OWASP Rules is located, it is selected what information will be shown.
Information that can be selected and comes selected by default includes;
- Actions
- Rule Type
- Description
- Active In
- Activation Status
- Rule ID
- Risk Level
- 2 (Add)
By clicking on the Add button, a form to create a new OWASP Rule is opened.
- 3 (Delete)
By selecting one or more OWASP Rules and clicking the Delete button, the relevant OWASP Rules are deleted from the TR7 ASP device.
- 4 (Enable)
By selecting the rule or rules that are Inactive and clicking the Enable button, the related rules are reactivated.
- 5 (Disable)
By selecting the rule or rules to be Deactivated and clicking the Disable button, the related rules are deactivated.
- 6 (Search)
Used to search for all expressions in the table.
- 7 (RegExp Search)
Used to regexp search for all expressions in the table.
- 8 (Column Based Search)
Used to column based search for all expressions in the table.
- 9 (Edit)
By clicking on the Edit icon, the editing screen for the relevant OWASP Rule is opened.
- 10 (Page Information)
In the opened list, information about how many OWASP Rules there are and how many are listed is displayed. When OWASP Rules are selected from the left side for deletion, the information about the selected OWASP Rules is also displayed here.
- 11 (Page Size)
In the opened list, it is selected how many OWASP Rules will be listed at maximum. Pages can be navigated using the arrow icons.
Interface
OWASP Rule Adding Form
By clicking on the OWASP Rules button on the WAF management screen of the relevant vService on the TR7 ASP device and following the Add Rule* steps, a form to manually add a new OWASP rule is opened.
- Activation Status
Selected to add the rule as Active or Inactive.
- Description
The name to be displayed on the OWASP Rules drop-down screen is entered.
- Regex
The Regex information for the rule to be added is entered. Additionally, by clicking on the Calculator icon, the written Regex can be tested on the TR7 ASP interface.
- Risk Level
The risk scale for the rule to be added is selected.
- Attack Area
It is selected in which areas the rule to be added will be effective.
- Add
By clicking the Add button, the OWASP Rule is added.