How do I prepare the WAF for an application that is about to launch, while there is no traffic yet?

Short answer

Without waiting for traffic, the rule set is prepared in four ways. If the application has an OpenAPI or Swagger definition, the path, method and parameter rules are produced from the document with Import (OpenAPI) on the Page Types screen; the import is a merge, and a rule with the same path is replaced with the one derived from the document. If there is a rule set learned in a test environment, Export is done there and Import here; Import replaces all Page types of the group with the ones in the file. Known pages are written manually with Add. Before going live, while the test team browses the site, the group is kept in Learning Mode; if the other domain names on the same vService are in Blocking mode, the new domain name is moved to a separate Virtual Host Group, or the traffic of the test team is learned with a Conditional Learning identity.

Problem: A Rule Set Is Needed Without Traffic

When WAF is turned on, only the Any Paths rule is in the rule set of the group (Which default settings are created when WAF is enabled?). Analysis & Learning produces Page types from real traffic; in an application that has not gone live, the traffic that learning would rely on does not exist yet. For the rule set to be ready before going live, a document, another environment or controlled test traffic is used.

Solution: Four Methods

The methods can also be used together: for example, the API paths are taken from the OpenAPI document, and the remaining pages are learned with test traffic.

Your situation	Suitable method
The application has an OpenAPI 3.0 or Swagger 2.0 definition	Method 1: Import (OpenAPI)
The same application has been learned on a TR7 in the test environment	Method 2: Export and Import
A small number of known pages	Method 3: Add
The test team can browse the site before going live	Method 4: Learning with test traffic

Method 1: Import (OpenAPI) Recommended

• How it works Every path in the document is converted into a Page type, its operations into the Allowed Methods list, and the query and header parameters into the Check Fields allow lists; template parameters such as {id} are converted into the * glob character (the conversion of the document into rules).
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → mode card → page types → Import (OpenAPI)
• Requirement OpenAPI 3.0 (JSON or YAML) or Swagger 2.0; a .json, .yaml or .yml file
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Page Types screen

In the Left Monitor Panel, the vService is clicked in the WAF-Protected vServices category and the WAF Management tab is opened. The page types row on the mode card of the group is clicked; the rules of the group open on the Page Types tab (accessing the screen).

2

Adım 2 Select the file

Import (OpenAPI) on the toolbar is clicked and the definition file is selected (import steps).

3

Adım 3 Confirm

The Are you sure? question is confirmed with Yes. At the end of the operation, the OpenAPI import: N path applied notification is shown; if there are patterns that cannot be converted, they are listed as warnings. The import is a merge: existing rules that are not in the document are not touched, and a rule with the same path is replaced with the rule derived from the document. A third-party document does not change the Any paths rule. The change is applied without a separate deployment step; in a cluster setup, it is also sent to the peer device with the default auto-sync, and if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Page typesTR7 side

The Page types list and the page types number on the mode card are checked.

ExpectedThe paths in the document are in the list; the number increases

Method 2: Export and Import

• How it worksExport downloads all Page types of a group (including Any paths and Check fields) as a JSON file; Import loads the file into any group of another vService or device. Import is a full replacement: the existing Page types of the target group are deleted.
• Where it is opened Page types → Export · Import
• Requirement A rule set learned in the source environment
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Export on the source

On the Page Types screen of the source vService, Export on the toolbar is clicked; the file is downloaded without a confirmation question (export steps).

2

Adım 2 Select the file on the target

On the Page Types screen of the target group, Import on the toolbar is clicked and the file from step 1 is selected (import steps).

3

Adım 3 Confirm

The Are you sure? question is confirmed with Yes; the existing Page types of the group are replaced with the ones in the file. If the file cannot be parsed, the Corrupted WAF rules file error is given, and if it contains an invalid pattern, the Invalid WAF pattern (...) error is given, and the existing set does not change (validation and errors). The vService-wide settings (OWASP Protection Level, Checks, Whitelist & Blacklist) are not included in this file; they are set separately on the target.

Verification

1Page typesTR7 side

The Page types list of the target group is checked.

ExpectedThe Page types from the source

Method 3: Add

• How it works For every known page, the path pattern, the allowed methods and the path limits are defined manually (Add).
• Where it is opened Page types → Add
• Requirement None
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the add form

On the Page Types screen, Add on the toolbar is clicked (accessing the Page types screen).

2

Adım 2 Define the rule

Path is entered as a full path or a glob pattern; Allowed Methods, Path Length, Path Depth and OWASP are set.

3

Adım 3 Save

Add at the bottom of the form is clicked; the rule is added to the list. The parameter and body inspections are added from the Check Fields panel of the rule.

Verification

1Page typesTR7 side

The Page types list is checked.

ExpectedThe new rule is in the list

Method 4: Learning with Test Traffic

• How it works Before going live, the traffic produced as the test team browses is recorded for learning and converted into Page types with Analysis & Learning. If the domain name of the application is alone on the vService, the group is kept in Learning mode; if the other domain names on the same vService are in Blocking mode, the new domain name is moved to a separate Virtual Host Group, or the requests of the test team are recognized with a Conditional Learning identity.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Virtual Host Groups band · Learning Methods card
• Requirement WAF-enabled HTTP vService; modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the group add window for the new domain name (if needed)

If the other domain names on the same vService are in Blocking mode, the plus (+) icon on the title strip of the Virtual Host Groups band at the very bottom of the WAF Management tab is clicked (adding a host group).

2

Adım 2 Define the group

Virtual Host Group Name is entered, the new domain name (e.g. yeni.example.com) is written in the Virtual Host Patterns field, and Learning mode is selected in the WAF Mode field. The new group starts only with the Any paths rule; it does not inherit the rules of the other groups.

3

Adım 3 Save the group

Add at the bottom of the window is clicked.

4

Adım 4 Open the Learning methods window (if needed)

To learn without moving the group to Learning mode, the pencil icon of the Learning Methods card in the Learning & Reporting section is clicked (Learning Methods Edit screen).

5

Adım 5 Define the Conditional learning identity

Conditional Learning is turned on and the identity of the test team is entered: IPv4 addresses or blocks separated by spaces (e.g. 198.51.100.0/24) are written in the Conditional Learning IP field, or the value of the TR7-ANALYZE cookie or header that the test team will carry in its requests is written in the Conditional Learning Cookie or Conditional Learning Header field. Requests whose identity matches are processed within the learning scope independently of the mode of the group and are not blocked with a WAF decision.

6

Adım 6 Save

Edit at the bottom of the window is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually.

7

Adım 7 Have the site browsed

The test team browses all sections of the site; forms are submitted and API calls are made.

8

Adım 8 Open the analysis window

The Analysis & Learning text on the mode card of the group is clicked (creating a new analysis).

9

Adım 9 Start the analysis

Start Analyzing is clicked; the progress is followed on the bar on the mode card.

10

Adım 10 Open the analysis result

When the analysis is finished, the New badge that appears on the Analysis & Learning row is clicked.

11

Adım 11 Open the Analyze Page Types tab

Edit in the summary that opens is clicked; the Analyze Page Types tab opens. The tree of the learned directories is listed on the left, and the paths in the selected directory on the right.

12

Adım 12 Exclude the suspicious paths from the analysis

The paths that come out of the analysis are reviewed; only the paths for which a WAF rule will be created must remain in the list. It is recommended to exclude unknown or suspicious paths from the analysis manually: the rows are selected and Exclude from Analysis is clicked; these paths are added to the Excluded paths list and do not produce rules. The edits are written to the analysis record without a separate save step; the live rules change only with Apply.

13

Adım 13 Apply the analysis result

Apply on the Analyze Page Types tab is clicked and the Are you sure? question is confirmed (applying the analysis result). After going live, the Conditional learning identity fields are first emptied while the switch is on and saved, and then the window is opened again and the switch is turned off; if both are done in the same save, the old identity remains.

Verification

1Page typesTR7 side

After the analysis is applied, the page types number on the mode card of the group is checked.

ExpectedThe number increases; the browsed paths are in the list

Common Mistakes

• Assuming that Import performs a merge. JSON Import replaces all Page types of the group; a backup is taken first with Export. The one that performs a merge is Import (OpenAPI).
• Using an OpenAPI document that is not up to date. Endpoints that are not in the document are inspected with the Any Paths rule; new endpoints can produce false positives after going live.
• Leaving the Conditional learning or Teacher identities on after going live. Requests that carry this identity are not blocked with a WAF decision. The identity fields are emptied first, and then the switch is turned off; while the switch is off, the fields are hidden in the form, but the saved Conditional learning identity continues to be recognized (Conditional Learning).
• Writing an IPv6 address as the identity. Conditional Learning IP accepts only IPv4 addresses and blocks; IPv6 addresses are ignored and the form does not warn about this.
• Assuming that a new Virtual host group inherits the rules of the existing group. The new group starts only with the Any paths rule (Virtual Host Groups).
• Expecting AI learning to produce rules in an application without traffic. AI Learning evaluates the attack records with thresholds for the number of requests, clients, countries and ASN networks; these thresholds are not reached in the test stage.

How it is done in the documentation

• Import (OpenAPI) · The Conversion of the Document into Rules
• Import · What Is Import?
• Add · What Is Add?
• Learning Methods · Conditional Learning
• Virtual Host Groups · Adding and Editing a Host Group

Related questions

• Can I still keep learning certain traffic while in Blocking mode (Conditional Learning)?
• Can I use different modes for different domains on the same vService?
• What should I do first after enabling the WAF?