WAF Attack Group

What Is the WAF Attack Group Condition?

WAF Attack Group is a condition type used to make traffic routing and manipulation decisions according to the category (group) of the attacks detected by the TR7 Web Application Firewall (WAF).

Incoming Request

↓

WAF Analysis (Attack Detection)

↓

Detected attack:
ID: 110045
Group: SQL Injection

↓

Match: is the group in the configured list?
[ SQL Injection, Cross-Site Scripting ]

↓

Result: A match was found (SQL Injection)

The condition becomes evaluable when the request reaches the block threshold of the WAF or when a rule in monitor mode is triggered; if no WAF profile is bound to the vService, it silently does not match.

Thanks to this condition, all the attacks belonging to a specific attack category can be caught with a single condition.

TIP

This condition can be used only in vServices that are HTTP and have the WAF module active.

The Importance of the WAF Attack Group Condition

The WAF Attack Group condition is an ideal tool for creating general policies according to the attack categories.

With the WAF Attack Group condition:

• All the signatures in an attack category can be caught with a single condition,
• Category-based security policies can be created,
• When new attack signatures are added, they are automatically included in the condition,
• Different response strategies can be determined for different attack categories,
• Simpler and more manageable rule sets can be created.

WAF and Condition Integration:

Component	Role
WAF Profile	Attack detection and scoring
Condition	Condition matching according to the detected attack
Action	The action to be applied when the condition is met

Comparison of WAF Attack Group and WAF Attack ID

Approach	Advantage	Usage
WAF Attack Group	Comprehensive control	For category-based policies
WAF Attack ID	Precise control	For specific signatures

TIP

When an attack group is used, the new attack signatures added with TR7 updates are automatically included in the related group.

Supported vService Types

HTTP (WAF Must Be Active)

L7 TCP

Network

The condition can be used at both the request (At Request) and response (At Response) stages.

How to Add?

A new WAF Attack Group Condition can be added through the TR7 web management interface by following the steps below:

1. The Configuration Menu is opened by clicking the TR7 logo at the bottom left.
2. The Load Balancer → Conditions → Add steps are followed.
3. WAF attack group is selected as Criteria.
4. The related configurations of the condition are made.
5. The condition is added by clicking the Add button.

WAF Attack Group Condition Add Form

WAF Attack Group Condition Add Form

INFO

Condition Name

An optional name can be entered for the condition to be created.

This field is especially important in the following scenarios:

• When many conditions are defined under the same vService,
• When conditions with similar criteria need to be distinguished,
• When it is necessary to quickly understand which business rule the condition represents.

When this field is left empty, TR7 analyzes the content of the related condition and creates an automatic, descriptive name in the Condition Description field. This generated description is used as the name in condition lists.

INFO

Criteria Required

The field that determines the type of the condition; WAF attack group is selected from the searchable dropdown list. This selection determines the fields displayed in the form. The criterion cannot be changed after the condition is saved: if a different criterion is needed, a new condition is defined. For all criteria in the list and their scopes, the criteria catalog on the Conditions page can be referred to.

INFO

WAF Attack Signature Groups Required

The WAF attack groups to be checked are added in this field. More than one group can be added.

INFO

The group list consists of the categories in the WAF rule database: for example SQL Injection, Cross-Site Scripting, OS Command Execution, Path Traversal, SSRF, Encoding Evasion, LLM Prompt Injection, and the structural categories (Structure Limits, Structure Policies, Content Integrity, IP Reputation) can also be selected. The category of custom WAF rules is not offered in the list. The group labels are displayed in English in the interface.

TIP

When more than one group is added, the condition is met if any one of them matches (OR logic).

INFO

Condition Description

It is created automatically by TR7 in line with the entered criteria and values.

This description:

• which value the condition applies to,
• which criterion it works on,
• the quick understanding of the condition on listing screens

is produced dynamically by the system so as to provide these. In this criterion, the description does not show the selected groups but only the number of selected groups (e.g. WAF.signatureGroup(2)); giving a Condition Name is recommended in order to distinguish them.

INFO

Form Buttons

Add

The condition adding process is completed by clicking the Add button.

Add & Repeat

With the Add & Repeat button, the condition adding process is completed, and another new condition can be added with different configurations without leaving the related window.

Condition Added

Operational Usage Recommendations

• Category-Based Policy. Consistent security policies should be created by grouping similar attack types.
• Additional Measures for Critical Groups. Extra security actions should be defined for critical attack groups such as SQL Injection, OS Command Execution and Deserialization.
• ID Should Be Used for Specific Needs. If special processing is needed for a specific signature within a group, the WAF Attack ID condition should be preferred.
• Group Combinations. Management should be simplified by combining more than one related group in a single condition.