ADC

Custom keyword support for JSON payload

February 9, 2024

Contributed by:

B S R

Starting from NetScaler release 13.1 build 33.x, you can add keywords of your choice and check if these configured keywords are present in the JSON payload.

SQL injection and command injection have a predefined set of keywords or patterns that they look for in the incoming requests. These predefined sets of keywords might not cover all the keywords as per your requirement and might lead to an increase in the number of false positives. With this feature, you can add keywords that are not covered in the SQL injection and command injection checks and therefore, reduce the false positives.

After adding the keywords, configure the NetScaler appliance to check if the added keywords are detected in the incoming requests. Then configure the appliance to perform one of the following actions:

Add custom keywords using the CLI

Complete the following steps to add a custom keyword using the CLI:

Configure a web application firewall profile and define an action when the custom keyword is detected in the incoming request.
```
set appfw profile <profile-name> –blockKeywordAction (block | log | stats | none)

```
By default, blockKeywordAction is set to none.

Example:
```
set appfw profile test_profile -blockKeywordAction block

```

Bind the web application firewall profile with your custom keywords.

bind appfw profile <profile_name> -jsonblockkeyword <keyword_name> -key <expression> -JSONBlockkeywordURL <expression> -isRegex ( REGEX | NOTREGEX ) -JSONBlockKeywordType ( literal | PCRE ) [-comment <string>] [-resourceId <string>] [-RuleType ( ALLOW | DENY )] [-state ( ENABLED | DISABLED )] [-isAutoDeployed ( AUTODEPLOYED |NOTAUTODEPLOYED )]
<!--NeedCopy-->

Example:

To add blockkeyword as the custom keyword and bind it to test-profile, run the following command:

bind appfw profile test_profile -jsonblockKeyword "blockkeyword" -key id -jsonblockkeywordurL "/signup.php" JSONBlockKeywordType literal -state enable
<!--NeedCopy-->

View the statistics of the custom keyword in CLI

Run the following command to view the statistics of the custom keyword:

stat appfw profile <profile name>
<!--NeedCopy-->

Example:

stat appfw profile test_profile
<!--NeedCopy-->

Add custom keywords using the GUI

Complete the following steps to add keywords using the GUI:

Navigate to Security > NetScaler Web App Firewall Profile > Profiles.
Select a custom profile and click Edit.

Note

Make sure that the selected profile type is JSON.
Go to the Advanced Settings section and click Deny Rules.
Select the Block Keyword option for the JSON check type and click Edit.
Click Add and set the required parameters.
Click Create.

The custom keyword that you added is listed in the Block Keyword Deny Rules page.
Go to the Advanced Settings section and click Security Checks.
Select Block Keyword and click Action Settings.
Select the required actions and click OK.

View the statistics of the custom keyword in GUI

Complete the following steps to view the statistics of the custom keyword in the GUI:

Navigate to Security > NetScaler Web App Firewall > Profiles.
In the details pane, select a Web App Firewall profile and click Statistics.

The NetScaler Web App Firewall Statistics page displays the custom keyword traffic and violation details.
You can select Tabular View or switch to Graphical View to display the data in a tabular or graphical format.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Custom keyword support for JSON payload

February 9, 2024

Contributed by:

B S R

February 9, 2024

Contributed by:

B S R

Custom keyword support for JSON payload

Add custom keywords using the CLI

View the statistics of the custom keyword in CLI

Add custom keywords using the GUI

View the statistics of the custom keyword in GUI

In this article