WAF Rules (Page Types)

Page Types is the screen on which the WAF rules of a host group are listed and managed. Every page type is the combination of a path pattern and the inspection settings (the allowed HTTP methods, the path length and depth restrictions, the OWASP scanning and the field inspections) to be applied to the requests coming to that path.

The page type list is everything WAF knows about the protected application: which addresses exist, with which methods every address is called, which parameters it carries and within which limits these parameters stay are defined in this list. When a request arrives, WAF first matches the path of the request with this list; the request is inspected with the configuration of the matching rule.

A page type is actually a WAF rule

Every violation that is inspected is added to the attack score of the request. If the host group works in the Blocking mode and the total score reaches the blocking threshold, the request is blocked; otherwise the request is forwarded to the Backend Service. That is, whether an incoming request will be blocked or not is decided by looking at the page type that matches that request.

Where Do the Rules Come From?

The page types are produced from three sources:

Source	How it works
The learning analysis	Analysis & Learning examines the past traffic of the host group and produces page type and rule suggestions. The greater part of the rule base is normally formed this way.
Teaching over the log	When a request is taught with Allow or Teach on the Event Logs screen, the learned value is written to the rule that matches the path of that request. In most cases this rule is Any Paths; whether the learning will be written as a separate page type or not is determined by the Rule Creation Policy setting of the vService. The header scoped learnings, on the other hand, are written to the shared Any Paths rule under all conditions.
Manual definition	The rule is written directly with Add; in addition, it is produced from a file with Import and Import (OpenAPI).

Every rule in the list, independently of its source, is edited and deleted with the same screens.

Accessing the Screen

Left Monitor Panel is opened.
WAF-Protected vServices is selected from the category tabs at the top left.
The vServices defined on TR7 with WAF protection enabled are listed.
The vService to be monitored is clicked; the screen opens with the Dashboard tab that carries the vService's name.
The WAF Management tab is clicked on the screen that opens.
The N Page Types row below the mode card is clicked. The whole of the row is a link: both the pencil icon at the beginning and the text next to it open the same screen. The counter also includes the Any Paths rule.

The Page Types tab opens with the name of the related host group in its title (Default Host Group for the default group). Every host group keeps its own page type list separately; the screen always shows the rules of a single host group.

Page Types Listing Screen

The page type list of the selected host group is reached by following the WAF Management → N Page Types path. Adding, editing, deleting and merging a page type and exporting/importing the rule set are done over this screen.

Page Types Listing Screen

The table opens with the following columns by default:

Column	Description
Path	The path pattern of the page type. The paths with a glob pattern are shown with the highlight color and the catch-all rule with the italic Any Paths label.
Check Fields	The field inspections defined on the rule (e.g. `Form, Header, JSON, Query, Raw, Xml`).

There is no column hidden by default.

The Any Paths row written in italics is the ready (catch-all) rule of the group: it meets all the requests that do not match any page type and comes with the Form, Header, Json, Query, Raw and Xml field inspections in its default configuration. Path is not included in this list; the path inspections are not a separate field section but the settings on the rule itself. The rule can be removed from the list but it does not disappear: for Any Paths, the Delete operation means not deletion but resetting to the default. Since the deletion and the recreation take place in a single operation, the row does not disappear from the list even for a moment, only its content returns to the default. The common inspections of the rule, on the other hand, cannot be deleted under any condition.

The reset takes away the manually added inspections

With the reset, the default path settings, the six common field inspections and the recommended header argument rules come back; the argument inspections that the user has added manually to the Any Paths rule are lost. In addition, the reset always uses the default template: even if the vService works at a tight protection level, the rule is recreated with the loose template.

The items in the toolbar are arranged from left to right in the following order; the last two items (Page Information and Page Size) are located in the information strip below the table.

Columns

Which columns are shown in the table is selected. In the same panel, columns are reordered by dragging and alignment is selected per column; the row height is fitted to the page with the Fit rows to the page button, and the column layout is reset to default with the Reset button. The layout is stored per user.

Add

A new page type is added manually to the group by clicking the Add button; the detail is on the Add page.

Edit

The settings of the selected page type are changed by clicking the Edit button; the form is exactly the same as Add. The button is enabled only when a single page type is selected; the detail is on the Edit page.

Delete

When one or more page types are selected and the Delete button is clicked, the related rules are removed together with their Check Fields configurations; for Any Paths the operation is not deletion but resetting to the default. The detail is on the Delete page.

Merge

Two or more selected rules are combined into a single rule with the Merge button; it is used to fold similar exact path rules into a single glob rule. If there is Any Paths in the selection, the button is not enabled. The detail is on the Merge page.

Export

All the page types of the group are downloaded as a single JSON file by clicking the Export button; the detail is on the Export page.

Import

The exported JSON file is loaded back to the group by clicking the Import button; the rule set of the group is completely replaced. The detail is on the Import page.

Export (OpenAPI)

The rule set is downloaded as a standard OpenAPI 3.0 document by clicking the Export (OpenAPI) button; the detail is on the Export (OpenAPI) page.

Import (OpenAPI)

A page type is produced from an OpenAPI or Swagger definition file by clicking the Import (OpenAPI) button and it is merged with the existing rules. The detail is on the Import (OpenAPI) page.

Export Table

The table is exported as Excel, CSV or PDF by clicking the Export Table button. In the window that opens, the Columns to be exported are determined with Filename, Format and Data Source; the remaining fields are displayed according to the format: CSV Separator in CSV, Excel Sheet Name in Excel, Page Orientation and Page Size in PDF. Only the columns visible in the table are written to the file; it does not contain the rule configuration and cannot be loaded back with Import.

Search

Used to search all information in the table.

RegExp Search

Used to search all information in the table with a regular expression (RegExp).

Column Based Search

Used to perform a column-based search on the information in the table.

Page Information

The information about the number of page types displayed in the list is located: Showing N-M of T records and the number of selected page types (N selected, Nothing selected when there is no selection).

Page Size

The maximum number of page types to be displayed on the page is selected. The default is 100; the options are 5, 10, 20, 50, 100, 200, 500 and All. The selection is not stored.

Import and Import (OpenAPI) are not the same thing

Import puts the rule set in the file in place of the existing rules of the group. Import (OpenAPI), on the other hand, merges the paths in the document with the existing rules: the rule of a path that is mentioned in the document is completely replaced, and the rules that are not mentioned in the document stay as they are. Confusing the two operations leads to the rule set being lost unexpectedly.

Both operations ask only a general "Are you sure?" confirmation; they do not additionally warn about the complete replacement.

The OpenAPI document produced by TR7 itself also carries the Any Paths rule; when this document is imported, the Any Paths configuration of the group is replaced with the one in the document even in the merge mode. In third-party documents the Any Paths rule is not touched.

Right-Click Menu

When a row is right-clicked, a menu that has the path of the rule (Any Paths on the catch-all rule) in its title opens. The operations are applied only to the rule that is right-clicked; the selection made in the list does not affect the menu.

Operation	What it does
Edit	Opens the editing form of the rule; it is the same form as the `Edit` in the toolbar.
Delete	Deletes the right-clicked rule (resets it to the default for Any Paths); the same confirmation question as the deletion in the toolbar is displayed.

Preview of the Selected Page Type

When a row in the list is clicked, the detail panel of the rule opens on the right of the screen. In the title there is the path of the rule (the Any Paths label on the catch-all rule), and below it the name of the host group.

Operation	What it does
Copy	Copies the path of the rule to the clipboard.
Edit	Does the same as the Edit operation on the toolbar.
Delete	Does the same as the Delete operation on the toolbar.

There are seven tabs on the panel; the content of the tabs and the field inspections are explained on the Path Check Fields page:

Path

The allowed methods, the path length and depth, the path signature scanning.

Query

The query string inspections.

Header

The request header inspections.

JSON

The JSON body inspections.

XML

The XML body inspections.

Form

The form body and file upload inspections.

RAW

The raw body inspections.

Runtime: Rule Matching

When a request arrives, its path is matched with the page types of the host group in the following priority order:

01 · ExactExact (Full) PathIf there is a full path rule that matches the path exactly, it wins

02 · GlobGlob PathIf there is no exact match, all the glob rules that fit the path are evaluated together

03 · Any PathsAny PathsThe requests that do not match any rule are inspected with the settings of the catch-all rule

The inheritance is at the level of the inspection section and the argument: the field inspections that a rule does not define at all and the individual arguments that it does not define are completed by the glob rule that fits the path or by the Any Paths rule. The path settings of the rule itself, on the other hand, are applied as they are and take the place of the path settings of Any Paths for that path.

The priority between Exact, Glob and Any Paths is independent of the place of the rules in the list. In contrast, if more than one glob rule fits the same path and these define the same inspection section or the same argument, the rule that was defined first wins; the later ones only complete the sections and the arguments that the first rule does not define.