WAF-Protected vServices

WAF-Protected vServices is the place where a vService whose WAF protection is enabled is monitored and managed from a single screen. The screen brings together the attack panel of the vService, all its WAF configuration, its attack logs, its live statistics and its learning monitoring in tabs.

Since the protection is turned on separately for each vService, this screen is also per vService: the mode, the protection level, the learning state and the logs of a vService concern only itself. The rule set, on the other hand, is layered: the built-in signature library and the rules defined across the device are common to all the WAF-protected vServices, and the rules and exceptions specific to the vService are layered on top of them.

For the views across the device, the WAF-Protected vService List, Signature & Rule Library, Global WAF Event Log and Global WAF Report screens are used. The last two screens are closed to the accounts that are limited to certain vServices only.

If the protection is not turned on yet

How the WAF protection is enabled on a vService, the defaults created after the enabling and the recommended first steps are explained on the How to Enable WAF? page.

Accessing the Screen

1. Left Monitor Panel is opened.
2. WAF-Protected vServices is selected from the category tabs at the top left.
3. The vServices defined on TR7 with WAF protection enabled are listed.
4. The vService to be monitored is clicked; the screen opens with the Dashboard tab that carries the vService's name.

The category is open to the users who have the WAF authorization and is one of the default categories of the panel; since the panel tabs can be arranged per user, if it has been removed before, it is added again from the same selector. Since WAF works only on the vServices of the HTTP type, only this type is included in the list. The default primary metric of the list is WAF Blocked Requests; the vService name, the status color and this metric are displayed in the rows. WAF Mode or OWASP Protection Level can also be selected as the primary metric from the metric selection of the panel, and in the Advanced view these are added to the row as an additional metric.

The same management screen also opens when a row is selected on the WAF-Protected vService List screen.

The open tab is carried between the vServices

When it is passed from one vService to another, the tab that is open at that moment is preserved. Only the Event Logs and the learning monitoring tabs are not carried; in this case the screen opens with the Dashboard tab again.

Tabs

Tab	Visibility Condition	Content
The vService name	Always	The attack and learning panel of the vService (Dashboard).
WAF Management	If there is the WAF authorization	The WAF configuration of the vService: the mode, the rule set, the inspection settings, the learning and the reporting.
Event Logs	If there is the WAF authorization	The log screen on which the blocked and detected requests are examined one by one.
Live Stats	If there is the WAF authorization	The live counters and breakdowns that are refreshed once a second.
AI Learning & Teacher Tracking	If there is the WAF authorization and AI or teacher (Teacher) learning is enabled on the vService	The monitoring and the history of the rule suggestions produced by the automatic learning.

The name of the learning monitoring tab changes according to the learning form that is enabled: if only the artificial intelligence learning is enabled it appears as AI Learning Tracking, if only the teacher learning is enabled as Teacher Tracking, and if the two are enabled together as AI Learning & Teacher Tracking.

Besides these fixed tabs, the rule, analysis and report surfaces opened from WAF Management are also located on the same screen as closable tabs: OWASP rules, Page Types (with the host group name), the analysis screen and the WAF report. When they are closed, the screen returns to the WAF Management tab.

The screen requires the WAF authorization

The whole of the screen is protected with monitoring authorization in the WAF area; if this authorization does not exist, the screen does not open at all. When the screen is opened, the tabs are not bound to an additional authorization condition.

The same authorization is also sought for all the WAF metrics in the panels. On a user who has only the Load Balancer authorization, the screen does not open; the WAF dashboard is not listed in the switching menu of the Load Balancer dashboard either.

Division of Labor Between Tabs

What happened? Dashboard · Live Stats

Dashboard collects the attack, inspection and learning data in the selected time range in panels; Live Stats shows the current state of the same vService with counters that are refreshed every second.

Why did it happen? Event Logs

Which signatures the requests triggered one by one and which category and OWASP item they correspond to are examined here. The examination is bound to an action from the same screen: a false positive is taught with the Allow, Teach or Allow / Teach button according to the selection; the source of a real attack, on the other hand, is added to the blacklist of the vService or of the device from the operation menu of the client address on the preview panel.

What should change? WAF Management

The mode, the protection level, the exemptions, the blocking page, the learning methods, the notification and the reporting settings are collected in this tab. The rule editing, analysis and report production surfaces, on the other hand, are opened from here as separate tabs.

What has been learned? AI Learning & Teacher Tracking

What the automatic learning is about to learn at the moment and what it has softened so far are monitored; the suggestions can be applied manually.

Subpages

Dashboard

The attack and learning panel: the view tabs, the preview panel that summarizes the configuration as a flow diagram, the time range and the panel controls.

→

WAF Management

All the WAF configuration of the vService: the mode cards, the rule set, the inspection, the learning and the reporting settings.

→

Event Logs

The attack logs: the Action decisions, the two-layer filtering, the three-tab preview, Allow/Teach and the blacklist.

→

Live Stats

The live statistics: the frontend counters, the inspection distribution, the attack category, the OWASP and the country breakdowns.

→

AI Learning & Teacher Tracking

The learning monitoring: the monitoring of the rule suggestions, the learning history, the manual application and the learning progress.

→