tencent cloud

This document describes how to configure protection rules in Web Application Firewall (WAF) to defend against web attacks.

Overview

WAF uses a regex-based rule protection engine and a machine learning-based AI protection engine to defend against web vulnerabilities and unknown threats.

WAF's rule protection engine provides expert rule sets based on Tencent Security's accumulated web threat intelligence to automatically prevent OWASP top 10 attacks. Currently, it can defend against 17 categories of common web attacks, such as SQL injections, XSS attacks, malicious scanning, command injection attacks, web application vulnerabilities, WebShell uploads, non-compliant protocols, and trojans.

WAF's rule protection engine supports rule level configuration. You can set the rule protection level according to your actual business needs and enable or disable rule sets, individual rules, and preset rules. You can also use the allowlist of specified URLs and rule IDs to process false positives.

Directions

Viewing the rule category

1. Log in to the WAF console and select Service Management > Web Rule Library on the left sidebar.
2. On the Protection rules tab, you can view the descriptions and rule updates of the attack categories that WAF currently can defend against.
   

Attack categories that WAF currently can defend against include:

3. You can view the rule updates on the right of the Protection rules tab. For more security notifications, please see Security Advisory.

Rule management

1. Log in to the WAF console and select Configuration Center > Basic Security on the left sidebar.
2. On the page that appears, click Web security. On the Rule engine tab, you can enable individual rules based on domain names. All rules are enabled by default.
   
3. You can search in the rule set by specifying the rule level, defense level, rule ID, attack category, or CVE number to view specific rules and perform operations.

   Note：

   The level "Strict" covers rules of the level "Normal" and "Loose", and "Normal" covers "Loose".

Rule allowlist and false positive processing

1. Log in to the WAF console and select Configuration Center > Basic Security on the left sidebar.
2. On the basic security page, click Web security. On the "Rule engine" tab, you can add domain name URLs and rule IDs to the allowlist and process false positives.
3. On the Rule engine tab, select the target rule, click Add to allowlist, and the custom rule adding window will pop up.
   
4. In the pop-up window, configure relevant parameters and click OK.
   

Field description

• Rule ID: ID of the rule that needs to be allowed. You can add one rule ID for each policy.
• Match method: Match method of the URL to be allowed. You can select "Exact match" (default value), "Prefix match", or "Suffix match".
• URL: URL path to be allowed. The URL must be unique under one domain name.
• Enable allowlist: It controls whether to enable allowlist, which is disabled by default.

5. After the allowlist is configured, click View allowlist to view the allowed rules and perform relevant operations.
   

Field description:

• Rule ID: ID of the rule added to the allowlist, which can be obtained through attack logs or rule management.
• Match method: Match method of the URL to be allowed. You can select "Exact match" (default value), "Prefix match", or "Suffix match".
• URL: URL path to be allowed. The URL must be unique under one domain name.
• Enable allowlist: It controls whether to enable allowlist.
• Last modified: The last time the rule was added or modified.
• Operation: It allows you to edit or delete a rule.

  - Click **Edit**, modify relevant parameters, and click **OK**.
  - Click **Delete** and confirm the deletion.