WAF Management

WAF Management is the tab on which the WAF configuration of a vService whose WAF protection is enabled is collected. The screen is not a form list but a summary surface that consists of setting cards: every card describes the current state of a set of settings in full sentences.

The editing element changes according to the level of the card. On the top level cards (the mode cards and the Virtual Host Groups band) the Edit text in the bottom right corner of the title strip, and on the subcards inside the bands the pencil icon at the top right of the card opens the related editing window. There is no editing element in the Inspection & Blocking and Learning & Reporting band titles; the editing is done only from the subcards inside the band.

The purpose of this design is to make the configuration readable. An administrator who looks at the cards sees the answers to all the questions "in which mode is this vService working, how many page types have been learned, which traffic is out of the inspection, what is the protection level, which page is returned to the blocked client, who receives the notification" on a single screen, with sentences instead of field names.

Accessing the Screen

Left Monitor Panel is opened.
WAF-Protected vServices is selected from the category tabs at the top left.
The vServices defined on TR7 with WAF protection enabled are listed.
The vService to be monitored is clicked; the screen opens with the Dashboard tab that carries the vService's name.
The WAF Management tab is clicked on the screen that opens.

Screen Structure

The screen consists of five bands from top to bottom:

Band	Its content
The mode cards	A card for every host group: the large title of the card is the name of the mode, and the group name stands below it as a small label; its color and its summary sentence change according to the mode. There are two rows below the card: the N page types row opens the Page Types of the group; in the Analysis & Learning row, on the other hand, there are two separate elements; the house icon at the beginning opens the list of the past analyses and the text itself opens the new analysis window.
The signature summary strip	Summarizes with which rule set the vService is protected at that moment: Total Active Signatures, Unique Signature Patterns and four boxes; Signature Categories, OWASP Web Coverage and OWASP API Coverage (both out of 10, with a progress bar) and Status (the Active / Monitor / Disabled distribution of the rules). The OWASP rules link at the bottom right opens OWASP Rules.
Inspection & Blocking	The five cards that determine how the requests are inspected and what will happen when an attack is caught.
Learning & Reporting	The cards that determine how the site is learned, to whom the notification will go and where the records will go.
Virtual Host Groups	The band at the very bottom of the screen: the management of the groups for which a separate rule set and a separate mode are defined according to the host header. The band shows an invitation to define while there is a single group, and a distribution summary in the form "Requests are evaluated in N host groups, each with its own WAF mode" while there is more than one group. The plus icon in the title adds a new group, and `Edit` opens the group list. If there is more than one group, the Collective Analysis & Learning row also appears inside the band.

The mode is applied to the host group

The mode applied to the traffic is always the mode of the host group. There is also a WAF mode field at the vService level, but this field determines only the default value for the newly created host groups and is not displayed as a card on this screen.

On a vService that works with a single host group, the card comes without a name and in practice describes the mode of the vService. When more than one group is defined, every group gets a separate card with its own name and its own color; the default group appears at the end of the list as Default host group. The page types and the learning state are also kept separately per group.

The settings that are off appear dimmed

The subcards that have an on/off state fade while they are off and carry a Disabled badge. These cards are: Checks, Whitelist & blacklist, Learning Methods, Periodic Reporting and Notifications. The other cards have no on/off state and always stay bright.

If a star (*) appears next to the Total Active Signatures number, it means that the low-score signatures that will never be triggered at the selected protection level have been subtracted from the count.

What Is Done Where?

Purpose	The way
Moving the protection from learning to blocking	The `Edit` on the mode card → the WAF mode field in the host group window that opens (WAF Mode)
Seeing or correcting the rule of a path	The N page types row → WAF Rules (Page Types)
Producing a rule suggestion from the past traffic	The Analysis & Learning row → Analysis & Learning
Turning a signature off only on this vService	The OWASP rules link on the signature strip → OWASP Rules
Reducing the false positives	OWASP Protection Level or Whitelist & Blacklist
Changing the page returned to the blocked user	Blocking Page
Being informed in an attack density	Notifications
Running different domain names in different modes on the same vService	Virtual Host Groups

Not everything is on this tab

The rule and signature editing surfaces work not inside this canvas but on separate tabs opened from here: OWASP rules, Page types (with the host group name), the analysis screen and the WAF report. These are closable tabs and when they are closed, the screen returns to WAF Management.