Can I review and edit the analysis result before applying it (Analyze Page Types screen)?

Short answer

Yes; the analysis result is a suggestion record and the live rules change only with Apply. The Analyze Page Types screen is opened from the window of the New badge on the mode card, with Edit in the Analyze list or with the Edit icon in the analysis preview. On the left the directory tree and on the right the elements of the selected directory are displayed; every row shows the number of requests and visitors and the Page has data icon. Suggest Globs suggests a glob pattern for similar addresses and adds the selected ones to the Dynamic paths list with Accept Selected Globs; Dynamic[path] (*) and Dynamic[everything] (**) gather the selected addresses into a pattern; Exclude from Analysis takes the addresses out of the tree; Add to Dynamic Path Exlusions makes the address preserve its own page type despite the pattern; the Advanced Settings window carries the thresholds and the Don't learn OWASP exclusions box. There are Reset, Undo and Redo; Reset removes all the edits and also removes the Don't learn OWASP exclusions check. Every change is written to the analysis record without a separate saving step and Current Page Count is recalculated; while the value exceeds 500, Apply is rejected. Before applying, the paths that come out in the analysis result are reviewed; only the paths for which a WAF rule will be created should remain in the list, and it is recommended that unknown or suspicious paths be excluded from the analysis with Exclude from Analysis.

Problem: The Analysis Result Produced Too Many Page Types

The analysis suggests a separate page type for each of the addresses that carry an ID, a date or an order number. If the result is applied as it is, the number of page types exceeds the 500 limit or every new ID value is blocked as an unlearned address. Similar addresses need to be gathered into a single pattern and irrelevant directories need to be removed.

Solution

The editing is done on the Analyze Page Types screen; the screen works on the analysis record and does not touch the live rules until Apply.

Analyze Page Types Screen

• How it works The suggested page tree is narrowed with glob patterns, exclusion lists and thresholds, and then applied.
• Where it is opened WAF Management → mode card → New badge → Edit · or the house icon on the mode card → Analyze list → Edit
• Requirement Modify permission in the WAF area · a completed analysis that contains logs
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the result window of the analysis

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the New badge on the mode card of the host group is clicked.

2

Adım 2 Open the Analyze Page Types screen

In the window that opens, Edit is clicked; the Analyze Page Types tab opens. If there is no processed log in the analysis, the tab does not open and deleting the analysis is suggested.

3

Adım 3 Select the branch

In the tree on the left, the directory to be edited is clicked; in the right pane, the elements in the directory (15 rows per page) are listed. When a branch in the tree is right-clicked, the same operations also run for that branch.

4

Adım 4 Open the glob suggestion form

Suggest Globs on the toolbar is clicked; the suggestion parameters form opens (Minimum Glob Depth 2, Minimum pages for a glob 3, Maximum consecutive stars (*, */* ...) 5, Globstar (**) off).

5

Adım 5 Fetch the suggestions

The Suggest Globs button in the form is clicked; the suggestions are listed with the Glob, Glob members and similarity columns.

6

Adım 6 Accept the suggestions

Suitable patterns are selected and Accept Selected Globs is clicked; the patterns are added to the Dynamic Paths list (Suggest Globs). If the pattern is to be created manually, elements are selected in the right pane and Dynamic[path] (*) or Dynamic[everything] (**) is used (What are Dynamic Paths, Excluded Paths and Dynamic Path Exclusions for?).

7

Adım 7 Review the paths and remove the irrelevant addresses

The paths that come out in the analysis result are reviewed one by one in the tree; only the paths for which a WAF rule will be created should remain in the list. Unknown or suspicious paths and test or obsolete directories are selected and excluded from the analysis by clicking Exclude from Analysis; these addresses are added to the Excluded Paths list and produce no rule. An address that must preserve its own rule within a pattern is selected and Add to Dynamic Path Exlusions is clicked (Exclude from Analysis).

8

Adım 8 Open the Advanced Settings window

Advanced Settings on the toolbar is clicked; the window carries the Excluded Paths, Dynamic Paths, Dynamic Path Exclusions and Filter groups.

9

Adım 9 Set the thresholds

In the Filter group, Min Requests, Min Visitors, Min Ips and Country Limit (Why are there Min Requests, Min Visitors, Min Ips, Country Limit filters?) and Don't Learn OWASP Exclusions (When should the "Don't Learn OWASP Exclusions" option be checked?) are set.

10

Adım 10 Save the window

Accept is clicked; the change is written to the analysis record and Current Page Count is recalculated.

11

Adım 11 Apply

When Current Page Count drops to 500 or below, Apply on the toolbar is clicked; the Are you sure? question opens.

12

Adım 12 Confirm

The Are you sure? question is confirmed with Yes; a progress bar appears on the toolbar and the screen is closed to editing. When it finishes, the "Rules applied" notification appears (What happens when I apply an analysis result?).

Verification

1CounterTR7 side

The analysis summary opened with the information icon at the right of the toolbar, or the Current Page Count column in the Analyze list, is examined.

ExpectedCurrent page count ≤ 500

The information icon is displayed when the screen is opened from the New badge or from the Edit icon in the preview; it does not appear in the tab opened with Edit in the Analyze list.

Common Mistakes

• Clicking Apply without editing the tree. If the number of page types exceeds 500, applying is rejected with the "The tree has too many rules" error; even if it does not exceed it, unnecessary rule maintenance arises.
• Thinking that Reset undoes only the last step. Reset clears all the edits and lists, removes the Don't Learn OWASP Exclusions check and empties the Max Logs per Path field; Undo is used for a single step.
• Not verifying Don't learn OWASP exclusions after Reset. If the result is applied with the check removed, the signature matches in the learning log are written to the OWASP exclusion.
• Applying without reviewing the paths. Unknown or suspicious addresses mixed into the analysis are also written as page types; before applying, they are removed with Exclude from Analysis.
• Leaving the addresses that carry an ID one by one. Every ID becomes a separate page type; they are gathered with a glob.

How it is done in the documentation

• Analysis & Learning · The Analyze Page Types Screen
• Analysis & Learning · Suggest Globs
• Analysis & Learning · Advanced Settings
• Analysis & Learning · Reset

Related questions

• What are Dynamic Paths, Excluded Paths and Dynamic Path Exclusions for?
• What happens when I apply an analysis result?
• How are glob patterns (*, **) written; how is the path test tool used?