Can I manage the WAF with WEB-CLI; which operations are not available in WEB-CLI?

Short answer

Yes, at the configuration level. WEB-CLI at the bottom right of the panel (or the same CLI over SSH) manages four layers with the waf command branch (command map): waf options (vService WAF settings: protection level, Checks, blocking page, blacklist, body processing, learning methods, periodic report, notification, SIEM content), waf host-groups (host groups and WAF Mode), waf fw-rules (page types) and waf rule-parts (Check Fields parts). For bulk operations there is update-many, and for returning to the default there are add-arg-headers and reset-rules; turning on WAF on a vService is done with the --waf field of the lb service update command. WEB-CLI is a client of the REST API on the device; the commands run with the role permissions of the user (permission and role scope) and every write is recorded in User Logs. Not available in WEB-CLI: Signature & Rule Library and the OWASP Rules layer of the vService, Page Types Export and Import and the OpenAPI formats, Merge, Analysis & Learning, Event Logs, Allow / Teach, manually applying AI learning suggestions (Learn Selected), Revert Learning and report generation; these are done from the interface.

How Does It Work?

1. The WEB-CLI window is opened with the WEB-CLI button at the bottom right corner of the panel; users with Access CLI over SSH on also connect to the same command engine over SSH. The button appears only for users with Access CLI over WEB on.
2. Every command in the waf branch goes to the REST API on the device as a request; the same field definitions and validations as in the interface forms are applied. The REST endpoints are documented in API7 Docs.
3. The waf branch is bound to the WAF permission area: reading commands (list, show) require view permission in the WAF area, and writing commands require modify permission; for a command outside the permission, Permission denied. is returned. A user restricted to specific vServices works only on its own vServices; a command that writes to another vService is rejected with the This vService is outside the vServices your account is restricted to — you cannot change it message.
4. Every writing command is recorded in User Logs as Field = WAF; in records originating from WEB-CLI, @web-console is added to the User-agent cell, and in those originating from SSH, @ssh is added (Where do I see the change history of WAF settings?).
5. The change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

What Is Available in WEB-CLI

The layers are nested: host groups are selected with poolId, page types with poolId and hostGroupId, and parts additionally with ruleId; these ID fields are written without -- in front of them (writing of the ID fields).

Layer	Command	Actions	Counterpart in the interface
vService WAF settings	waf options	show · update · update-many	The setting cards in WAF Management
Host groups	waf host-groups	list · show · add · update · delete · update-many · add-arg-headers · reset-rules	Mode cards and Virtual Host Groups
Page types	waf fw-rules	list · show · add · update · delete · add-arg-headers	Page Types list
Check fields parts	waf rule-parts	list · show · add · update · delete	The Check fields tabs of the page type
Turning WAF on and off	lb service	update · update-many (--waf true / --waf false)	WAF-Protected vService List and the WAF box in the vService form

Example commands: displaying the WAF settings and the host groups of a vService, setting a group to Monitor mode, turning WAF on in a vService (How do I enable WAF protection on a vService?):

waf options show poolId <vService>
waf host-groups list poolId <vService>
waf host-groups update poolId <vService> id <group> --mode monitor
lb service update id <vService> --waf true

Using the bulk commands: Can I change the WAF settings or host group mode of several vServices at once?

What Is Not Available in WEB-CLI

Operation	Its place in the interface
Signature status, score, scope and custom rules (global layer)	Configuration Menu → WAF → Signature & Rule Library (What is the difference between the vService's OWASP Rules screen and the global Signature & Rule Library screen?)
Signature changes of a single vService (vService layer)	WAF Management → signature summary strip → OWASP Rules
Saving the rule set to a file and loading it from a file (JSON and OpenAPI)	Page types → Export · Import · Export (OpenAPI) · Import (OpenAPI) (Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?)
Merging page types	Page types → Merge
Generating rules from past traffic	Mode card → Analysis & Learning (How do I generate rules from past traffic with Analysis & Learning?)
Viewing records and teaching from a record	Event Logs → Allow / Teach (How do I allow a request that was blocked by mistake?)
Manually applying AI learning suggestions, undoing a learning	AI Learning & Teacher Tracking → Learn Selected · the Log tab of the vService → Revert Learning (Can I revert a learned rule?)
Generating reports	WAF report, Global WAF Report (How is a WAF report created; which formats are available in the UI and by e-mail (HTML, PDF, XLSX)?)

The settings of the periodic e-mail report and of the notifications are in waf options; the report itself is not generated from WEB-CLI.

Common Misconceptions

• "Signature statuses are changed with WEB-CLI." The signature layers (global and vService) are managed only from the interface.
• "The rule file is imported with WEB-CLI." File transfer is only on the Page types screen; in WEB-CLI, rules can be written one by one with waf fw-rules and waf rule-parts.
• "A bulk protection level change also builds the rule set according to the level." waf options update-many does not accept the --syncWithDefaultFwRules field; when switching to the Aggressive level or leaving Aggressive, waf host-groups reset-rules is used to build the Any paths rule with the default definition of the new level.
• "A change made with WEB-CLI is not recorded." Every write is recorded in User Logs with the @web-console or @ssh mark that shows its source.

How it is done in the documentation

• WEB-CLI waf · Command Map
• WEB-CLI waf · Layers
• WEB-CLI · The Permission: the role scope
• API Commands · Bulk Update (update-many)

Related questions

• Can I manage the Load Balancer configuration via CLI or API?
• Can I change the WAF settings or host group mode of several vServices at once?
• How do I reset the rules to the default settings?
• How is a consistent WAF policy managed across many vServices?