Configuring the Web App Firewall

• Enabling the Web App Firewall

• The Web App Firewall Wizard

• Manual Configuration

• Manual Configuration By Using the Configuration Utility

• Manual Configuration By Using the Command Line Interface

Signatures

• Manually Configuring the Signatures Feature

• Adding or Removing a Signatures Object

• Configuring or Modifying a Signatures Object

• Protecting JSON Applications using Signatures

• Updating a Signatures Object

• Signature Auto Update

• Snort rule integration

• Exporting a Signatures Object to a File

• Edit signatures to add or modify rules

  • To add a signature rule category

  • Add signature rule patterns

  • To Import and Merge Rules

• Signature Updates in High-Availability Deployment and Build Upgrades

Top-Level Protections

• HTML Cross-Site Scripting Check

• HTML SQL Injection Checks

• SQL grammar-based protection for HTML and JSON payload

• Command injection grammar-based protection for HTML payload

• Relaxation and deny rules for handling HTML SQL injection attacks

• HTML Command Injection Protection

• Custom keyword support for HTML payload

• XML External Entity Protection

• Buffer Overflow Check

• Web App Firewall Support for Google Web Toolkit

Cookie Protection

• Cookie Consistency Check

• Cookie Hijacking Protection

• SameSite cookie attribute

Data Leak Prevention Checks

• Credit Card Check

• Safe Object Check

Advanced Form Protection Checks

• Field Formats Check

• Form Field Consistency Check

• CSRF Form Tagging Check

• Managing CSRF Form Tagging Check Relaxations

URL Protection Checks

• Start URL Check

• Deny URL Check

XML Protection Checks

• XML Format Check

• XML Denial-of-Service Check

• XML Cross-Site Scripting Check

• XML SQL Injection Check

• XML Attachment Check

• Web Services Interoperability Check

• XML Message Validation Check

• XML SOAP Fault Filtering Check

JSON Protection Checks

• JSON DOS Protection

• JSON SQL Protection

• JSON cross-site scripting Protection

• JSON Command Injection Protection

• Custom keyword support for JSON payload

Profiles

• Creating Web App Firewall Profiles

• Enforce HTTP RFC compliance

• Configuring Web App Firewall Profiles

• Changing an Web App Firewall Profile Type

• Web App Firewall Profile Settings

• Detailed troubleshooting with WAF logs

• Manage the global bypass and deny lists

• File Upload Protection

• Exporting and Importing an Web App Firewall Profile

• Configuring and Using the Learning Feature

• Dynamic Profiling

• Supplemental Information about Profiles

• Custom error status and message for HTML, XML, or JSON error object

Policies

• Firewall Policies

  • Creating and Configuring Web App Firewall Policies

  • Binding Web App Firewall Policies

  • Viewing a Firewall Policy's Bindings

  • Supplemental Information about Web App Firewall Policies

• Auditing Policies

Imports

• Importing and Exporting Files

Global Configuration

• Engine Settings

• Confidential Fields

• Field Types

• XML Content Types

• JSON Content Types

Appendices

• PCRE Character Encoding Format

• Whitehat WASC Signature Types for WAF Use

• Streaming Support for Request Processing

• Trace HTML Requests with Security Logs

• Web App Firewall Support for Cluster Configurations

Debugging and Troubleshooting

• High CPU

• Memory

• Large File Upload Failure

• Learning

• Signatures

• Trace Log

• Miscellaneous

• References

Signatures Alert Articles

• Signature update version 111

• Signature update version 110

• Signature update version 109

• Signature update version 108

• Signature update version 107

• Signature update version 106

• Signature update version 105