Positive Security: Page Types

Page types, Any Paths, glob patterns, Merge, Import and Export.

• What is a Page Type?WAF-06-001
• What is the Any Paths rule?WAF-06-002
• Where do WAF rules come from (learning analysis, teaching from logs, manual definition)?WAF-06-003
• How do I add a new page type manually?WAF-06-004
• What is the difference between an Exact Path and a glob path?WAF-06-005
• How are glob patterns (*, **) written; how is the path test tool used?WAF-06-006
• Can I allow only certain HTTP methods on a page (Allowed Methods)?WAF-06-007
• What are the Path Length and Path Depth constraints for?WAF-06-008
• If a request matches more than one page type, how are the rules applied (exact path priority, glob rules merged with Any Paths)?WAF-06-009
• How is a request that matches no page type inspected?WAF-06-010
• Can I delete the Any Paths rule?WAF-06-011
• How do I merge several page types into one rule (Merge)?WAF-06-012
• How are settings (methods, OWASP) combined during a Merge?WAF-06-013
• Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?WAF-06-014
• What happens to existing rules when I Import (full replacement)?WAF-06-015
• Can I generate rules automatically from my OpenAPI / Swagger file?WAF-06-016
• What does turning OWASP scanning on or off at the Page Type level mean?WAF-06-017
• What do the Force Merge and Keep Original Rules options do?WAF-06-018
• How do I reset the rules to the default settings?WAF-06-019
• Why can't the Any Paths rule be merged with other rules?WAF-06-020