Can I take a different action on the Load Balancer side based on the attack the WAF detected (WAF Attack Signature / Signature Group condition)?

Short answer

Yes. There are two WAF criteria in the Load Balancer conditions (Conditions): WAF Attack Signature catches the selected signatures, and WAF Attack Signature Group catches all the signatures of the selected attack categories; for only the "did the WAF block" question, the If is a WAF block ready-made condition is used. The condition is bound to an action (such as Block, Show Content, Location Redirection, Quarantine, Add HTTP Header) and the action is added to the Actions field in the Details list of the vService. The WAF criteria match when the WAF produces an attack record for that request: when the request reaches the blocking threshold (even if the host group is in Monitor mode) or when a signature whose status is Monitor is triggered. They do not match in Learning mode or for single detections that stay below the threshold; If is a WAF block matches only when the WAF actually blocks the request in Blocking mode. Since actions run before the WAF's blocking page (Blocking Page), an action that ends the request returns its own response; after an action that does not end the request, such as Add HTTP Header, the WAF block is applied as it is. In this way, only specific categories can be blocked in a host group in Monitor mode, or the WAF score can be forwarded to the Backend Service with a header. If only the blocking page is to change, the WAF's Conditional Blocking Pages field is used. The criteria work only on an HTTP vService with WAF on.

Problem: Different Behavior Is Needed According to the WAF's Decision

Even though the host group is still in Monitor mode, it may be wanted that specific attack categories (e.g. SQL Injection) are already blocked, that a special response is given when a specific signature is triggered, that the attacker is quarantined or that the WAF's score is forwarded to the Backend Service. The WAF's own settings give the decision only as block or monitor; a different behavior according to the detected attack is set up with Load Balancer conditions and actions.

Solution: 3 Methods

Your situation	Suitable method
Blocking, redirecting, quarantining, adding a header according to the detected signature or category	Method 1: Condition + action
In Blocking mode, I want to change only the blocking page according to the category	Method 2: Conditional Blocking Pages
From the command line	Method 3: WEB-CLI

Method 1: Condition + Action Recommended

• How it works The condition with a WAF criterion reads the result of the WAF scan; the action bound to the condition runs in the vService's Actions list, before the WAF's blocking response.
• Where it is openedLoad Balancer → Conditions · Load Balancer → Actions · vService → Details → Actions
• Requirement WAF on in the vService; the host group in Monitor or Blocking mode (the condition does not match in Learning mode)
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the condition form

The Configuration Menu is opened with the TR7 logo at the bottom left; on the Load Balancer → Conditions screen, Add is clicked (how to add).

2

Adım 2 Select the WAF criterion

Condition Name is entered (if it is left empty, an automatic description showing only the number of selections appears in the list). In the Criteria field, the selection is made according to the need:

Criteria	Field to fill in	Match
WAF Attack Signature Group	WAF Attack Signature Groups: one or more categories (e.g. SQL Injection, Cross-Site Scripting)	If any signature from the selected categories is in the attack record
WAF Attack Signature	WAF Attack Signatures: one or more signatures, searched by rule name	If any of the selected signatures is in the attack record

The lists contain the built-in signatures and the structural rules; custom WAF rules are not listed. Criteria cannot be changed after it is saved.

3

Adım 3 Save the condition

Add is clicked; the condition is added to the list.

4

Adım 4 Open the action form

On the Load Balancer → Actions screen, Add is clicked (how to add).

5

Adım 5 Select the action and the condition

Action Name is entered, Execution Level = On Request is left as it is and Action Type is selected according to the need:

Purpose	Action Type	Setting
Blocking the category	Block	Deny Type = Standard, Status Code default 403
Showing a special page	Show Content	Content Page and Status Code (since its default is 200, a code such as 403 is selected)
Sending to another address	Location Redirection	Target address and redirect code
Blocking the attacker completely for a period	Quarantine	Duration and tracking key (How does the Quarantine Action work; how long is a client that exceeds the threshold blocked?)
Forwarding the WAF score to the Backend Service	Add HTTP Header	Header to Add (e.g. X-WAF-Score) and the WAF Score variable (%WAFSCORE) with fx in the Header Content field (WAF variables)

In the Conditions field, the condition created in step 3 is selected. If only the requests that the WAF blocks are to be acted on, the ready-made If is a WAF block condition is selected. Optionally, Hit Counter is turned on.

6

Adım 6 Save the action

Add is clicked; the action is added to the list.

7

Adım 7 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService with WAF on is selected and Edit is clicked.

8

Adım 8 Add the action to the vService

The action is selected in the Actions field under Details. Actions run in the order in the list; after an action that ends the request, the following ones do not run (action ordering).

9

Adım 9 Save

Save is clicked; there is no separate deployment step. The action does not run unless it is added to the vService. In a cluster, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually with Synchronize.

Verification

1The action's responseClient side

A test request that triggers the selected category is sent (the example is for the SQL Injection category).

Command: curl -s -o /dev/null -w "%{http_code}\n" "https://www.example.com/?id=1%27%20OR%20%271%27=%271"

Expected403

While the host group is in Monitor mode, the WAF does not block on its own; the 403 comes from the Block action. Requests that do not fall into the category get the normal response.

2Record and counterTR7 side

The attack record of the request on the WAF Event Logs screen is examined; if Hit Counter is on, the Action Hits tab of the vService Dashboard is examined.

ExpectedThe attack record is created, the action counter increases

If Debug is on in the vService, the layer that ended the request is seen on the Summary tab of the Debug Mode Logs record.

Method 2: Conditional Blocking Pages

• How it works When the WAF blocks a request, the conditional pages are tried in the order of definition, and the page and status code of the first row whose condition matches are returned; if none matches, the default blocking page is returned.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Inspection & Blocking → Blocking Page card
• Requirement The host group in Blocking mode; a condition with a WAF criterion created as in steps 1–3; a Content Pages profile for the page to be shown
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Create the condition

By applying steps 1–3 of Method 1, the WAF Attack Signature Group (or WAF Attack Signature) condition is created.

2

Adım 2 Open the Blocking Page window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Blocking Page card in the Inspection & Blocking section is clicked (Blocking Page Edit screen).

3

Adım 3 Add a conditional page row

In the Conditional Blocking Pages field, Add Conditional Page is clicked.

4

Adım 4 Fill in the row

The condition from step 1 is selected in the Condition field, and the content profile to be shown in the Page Profile field; Status Code comes as Use Default Status Code (Blocking Status Code, default 418) by default, and if needed, a code specific to the row is selected. A row whose condition is left empty matches every blocked request; since the rows are tried in order, the rows after that row and the default blocking page are not used. For this reason, a condition is selected in every row.

5

Adım 5 Save

Edit is clicked; there is no separate deployment step. Details: Can I define different blocking pages depending on conditions (Conditional Blocking Pages)?

Verification

1PageClient side

A request that triggers the category in the condition is sent.

Command: curl -s -i "https://www.example.com/?id=1%27%20OR%20%271%27=%271"

ExpectedThe status code and page content selected in the row

Method 3: WEB-CLI

• How it works The condition, action and binding in Method 1 are done with WEB-CLI commands. In WEB-CLI, the names of the criteria are waf_attack_id and waf_attack_group.
• Where it is opened WEB-CLI → lb condition · lb action · lb service
• Requirement WEB-CLI access
• vService type HTTP (the example is with the Block action)

Step-by-Step Configuration

1

Adım 1 Create the condition

The category is written with its key in the WAF rule database (e.g. sqlInjection for SQL Injection, xss for Cross-Site Scripting); for a single signature, the signature ID is given with criteria waf_attack_id --wafAttackIds.0:

lb condition add criteria waf_attack_group --wafAttackGroups.0 sqlInjection --name waf-sqli

The command gives no output when it succeeds.

2

Adım 2 Get the condition ID

The --cond field takes the ID of the condition, not its name. The ID is read from the id column of the list (it starts with lbConditions-):

lb condition list

3

Adım 3 Create the Block action

In place of <condition-id>, the ID from step 2 is written; the Status Code default is 403 (action examples):

lb action add type deny name waf-sqli-block --cond <condition-id>

4

Adım 4 See the existing actions of the vService

lb service show <vService>

The rules.0, rules.1 … lines in the output are the actions defined on the vService.

5

Adım 5 Add the action to the first empty position

--rules.N replaces the existing action at that position; for this reason, the new action is written to the first empty position. If the vService has no actions, the position is 0; if it has two actions, --rules.2 is used:

lb service update id <vService> --rules.0 waf-sqli-block

Verification

1BindingTR7 side

The vService record is displayed again.

Command: lb service show <vService>

Expectedwaf-sqli-block in the rules lines

A request that triggers the category gets 403 as in Method 1.

Common Mistakes

• Expecting the condition to match in Learning mode. In Learning mode, the WAF does not produce attack records; conditions with a WAF criterion do not match. The host group is set to at least Monitor mode.
• Using If is a WAF block in Monitor mode. Since the WAF does not block the request in Monitor mode, this condition does not match; in Monitor mode, WAF Attack Signature or WAF Attack Signature Group is used.
• Expecting a match for detections below the threshold. The condition matches in requests that reach the blocking threshold or that trigger a signature whose status is Monitor; low-score signatures that do not reach the threshold on their own do not trigger the condition.
• Thinking that an action that ends the request removes the WAF record. The WAF attack record and counters are still created; only the response that goes to the client changes.
• Creating the condition and not adding the action to the vService. The condition and the action do not work on their own; the action is added to the Actions field of the vService and saved with Save.
• Overwriting the existing action with --rules.0 in WEB-CLI. An action written to an occupied position replaces the one there; the first empty position is first found with lb service show.
• Using the condition on an L7 TCP or Network vService. The WAF criteria match only on an HTTP vService with WAF on.

How it is done in the documentation

• WAF Attack ID · What Is the WAF Attack ID Condition?
• WAF Attack Group · WAF Attack Signature Groups
• Actions · Action Ordering and Priority
• Blocking Page · Conditional Blocking Pages
• WEB-CLI · The Identity and WAF Criteria

Related questions

• Can I define different blocking pages depending on conditions (Conditional Blocking Pages)?
• What are Condition and Action, and what are they used for?
• How does the Quarantine Action work; how long is a client that exceeds the threshold blocked?