Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How does scope (Global, Source IP, Source Subnet, Country, ASN, Host Header …) work in advanced notifications?
Short answer
Scope determines what the advanced notification trigger counts by: a separate counter is kept for each value of the scope (each source IP, each network, each country, each ASN, each host), and a separate notification is sent for each value whose count within the Window period exceeds the Threshold value. Global (all traffic) gathers all the traffic in a single counter; Source IP counts by the client address, Source Subnet by the network of IPv4 Prefix (default 24) and IPv6 Prefix (default 64) length, Country by the country, ASN by the ASN value of the client, Network Type Group and Network Type Category by the network type, and Host Header by the Host header of the request. Each scope has a lowest threshold (e.g. Source IP 5, Global 20). The window is between 30 seconds and 1 hour; when the count falls below 80% of the threshold, the alarm closes, and while the alarm continues, the notification is repeated at certain intervals. At most 6 triggers can be defined on a vService; Advanced Notifications is located in the Notifications window on WAF Management.
How Does It Work?
A trigger consists of five parts: Scope, Count (Blocks or Detections), Window, Threshold and the optional Report Attachment. A new trigger comes with the values Country, Blocks, 5 minutes and 100.
| Scope | Counter key | Lowest Threshold | Report Attachment |
|---|---|---|---|
| Global (all traffic) | A single counter; all the traffic | 20 | Yes (unfiltered report) |
| Source IP | The IP address of the client | 5 | Yes (by that IP) |
| Source Subnet | The network of the client address: IPv4 Prefix 8–32 (default 24), IPv6 Prefix 16–128 (default 64) | 10 | Yes (by that network) |
| Country | The country of the client | 10 | Yes (by that country) |
| ASN | The ASN value of the client address | 10 | Yes (by that ASN) |
| Network Type Group | The type group of the client network | 10 | No |
| Network Type Category | The type category of the client network | 20 | No |
| Host Header | The Host header of the request (converted to lowercase) | 10 | Yes (by that host) |
- Count: Blocks counts only the blocked requests; Detections counts the blocked attack requests, those passed in Monitor mode and those recognized by Teacher (What is the difference between "Blocks" and "Detections" in a notification?).
- Threshold cannot be entered below the lowest value of the scope; the form gives the Threshold for this scope must be at least … warning.
- Window must be between 30 seconds and 1 hour; the counting is done over the requests in the last window period.
- If the same scope is used with two different prefix lengths, each one keeps a separate counter.
- The country and the network type are resolved from the geographic IP and network type database on the device (IP Intelligence & Reputation).
Alarm, Repetition and Closing
| Situation | Behavior |
|---|---|
| A key exceeded the threshold | A notification is sent (e.g. "web": WAF blocks from IP 198.51.100.7 over the threshold: …) |
| The alarm continues | The notification is repeated once every 6 times the window period; the interval is at least 30 minutes and at most 2 hours (every 30 minutes in a 5-minute window) |
| The count fell below 80% of the threshold | The alarm closes; the closing notification is sent only for the alarms that have been repeated at least once |
| Many keys exceeded the threshold at the same time | At most 100 keys are kept in alarm at the same time, and at most 10 new alarms are opened in each evaluation round; when the limit is reached, a separate warning notification is sent |
The notifications are seen on the Notification Logs screen with the name Advanced WAF Notification. If Report Attachment is selected, a WAF report that covers the alarm window and is filtered by the triggering key is attached to the e-mail; in Blocks counting, the report contains only the blocked records.
Defining in TR7
On the WAF Management tab, in the window opened with the pencil icon of the Notifications card, the Advanced Notifications switch is turned on, a trigger is added with Add Trigger (+), the fields are filled in and Edit is clicked. Channels and step-by-step setup: Can I receive a notification when the attack count exceeds a certain threshold?
In WEB-CLI, the same trigger is written with the --advancedNotifications.N.* fields; since N replaces the existing trigger at that position, the first empty position is first found with waf options show poolId <vService>. Example when there is no trigger (advanced notifications):
text
waf options update poolId <vService> --advancedNotifications.0.scope src_ip --advancedNotifications.0.countType block --advancedNotifications.0.window.val 5 --advancedNotifications.0.window.unit m --advancedNotifications.0.limit 100The scope values are global, src_ip, subnet, country, asn, nettype_group, nettype_category and host; the count values are block and detect; the window units are s, m and h. In WEB-CLI, if a limit below the lowest value of the scope is written (at least 1), the record is not rejected and the trigger works with that lowest value; the window, on the other hand, is not accepted outside 30 seconds – 1 hour.
Common Misconceptions
- "In the Global scope, each IP is counted separately." Global (all traffic) gathers all the traffic in a single counter; for counting per source, Source IP or Source Subnet is selected.
- "Threshold can be entered as low as desired." Each scope has a lowest value; a value below it cannot be entered.
- "When the alarm closes, a notification always arrives." A closing notification is sent only for the alarms that have been repeated at least once.
- "In the country or network type scope, certain countries can be excluded." In WAF triggers, there is no exclusion with a country and network type list; each value is counted separately.
- "The report attachment also comes in the network type scopes." In the Network Type Group and Network Type Category scopes, Report Attachment is not offered.
How it is done in the documentation
