Inspection & Blocking

Inspection & Blocking is the section of the WAF Management screen that carries in its sub note the explanation How requests are inspected and what happens when an attack is caught. The section consists of five setting cards and answers two questions: how the request is inspected and what happens when an attack is caught.

Every one of the cards corresponds to a different stop of the inspection: which traffic will be kept out of the inspection, which sources will be rejected from the beginning, how much of the body will be examined, which inspection families will run, at which threshold the accumulated attack score will turn into blocking and what will be returned to the blocked client are managed from here.

The cards and the editing

Every card summarizes the current state of the setting in full sentences; when the pencil icon at its top right is clicked, the related editing window opens.

When the Checks and Whitelist & Blacklist cards are turned off, they go dim and carry the Disabled pill. The other three cards always look active, because they have no main switch that can be turned off.

Its Place in the Inspection Flow

01 · ExemptionWhitelistThe selected traffic is left entirely outside the WAF inspection

02 · SourceBlacklistIf the source address is found in the lists, it is written as a violation of 100 points

03 · InspectionChecksThe signature scanning with the structural and field inspections are run

04 · ScopeRequest Body LimitsThe section of the body to be inspected is trimmed at the body stage of these inspections

05 · ThresholdOWASP Protection LevelThe accumulated score is compared with the blocking threshold of the selected level

06 · ResponseBlocking PageThe content and the status code returned to the blocked client are produced

The diagram shows the place of the cards in the inspection flow; Request Body Limits is not a single stop: the body waiting setting is applied while the request is being received, the processing limit at the body stage of the inspections, and the log limit while the record is being written after the decision has been made.

A Blacklist hit does not end the request on its own either: it is added to the attack score as a violation of 100 points. Since this value exceeds even the threshold of the loosest protection level, in the Blocking mode it turns into blocking at every level. The hit can come from three sources (the vService's own list, the global reputation feed and the selected categories) and is cancelled for the addresses in the exception list; the whole of the stage works while Blacklist Protection is on.

The blocking takes place only while the host group is working in the Blocking mode. In the Monitor mode all the inspections work in the same way, the attack is reported and the score is calculated, but the request is let through. In the Learning mode the structural and field inspections are not run at all; only the signature scanning is done, the attack score is not accumulated and the 03-06 steps of the diagram do not come into play.

If the inspection time runs out, the request is blocked

The time allocated for the WAF scanning of a request is limited. If the scanning is cut short because the time has run out, the request is not let through: an attack record of 100 points is produced with a synthetic rule and the request is blocked. These records are counted as a separate category (timeouted) on the monitoring screens.

The Setting Cards

OWASP Protection Level

The threshold at which the accumulated risk score of the violations will turn into blocking; the five levels and the false positive balance.

→

Checks

The Structure Checks and Argument Checks main switches, the Max. Allowed Arguments limit and the URL Decoding behavior.

→

Whitelist & Blacklist

Blocking the IPs with a bad reputation and the category selection, the IP lists specific to the vService, the static content and the conditional exemptions.

→

Blocking Page

The content, the content type and the status code returned to the blocked request; the conditional blocking pages (the first match wins) and the ready templates.

→

Request Body Limits

The processing limit of the body, the log limit and the time to be waited for the body to be completed.

→

The Related Screens

This section determines the frame of the inspection; the content of the inspection is defined on other screens:

• Which path can be called with which methods, with which parameters and within which limits is kept in the WAF Rules (Page Types) list.
• The attack patterns searched for in the requests are managed in the OWASP Rules view.
• The records produced as a result of the inspection are examined on the Event Logs screen.