Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Where can I see the rules in the library?
Short answer
The rules are seen on two screens. The device-wide library is listed on the Signature & Rule Library screen, opened via Configuration Menu → WAF → Signature & Rule Library; the built-in signatures, the structural inspection records and the global custom rules appear here. With which rule set a single vService really works, on the other hand, is seen on the OWASP Rules screen, opened with the OWASP rules link at the bottom right of the signature summary strip on that vService's WAF Management tab; this screen also lists the vService-specific rules and marks the signatures that the protection level does not scan. The two screens use the same table; when a row is clicked, the preview of the rule with the Signature and Classification tabs opens on the right. In WEB-CLI, there is no command for the signature library.
Problem: Where Is the Signature Library?
There is a need to see which signatures exist and what their states and scores are. Since the device-wide view and the set a single vService really uses are on different screens, it must be known which one is opened from where and what it shows.
Solution: Two Methods
The two screens show different layers of the same library; the two can also be used together.
| Your situation | Suitable method |
|---|---|
| Seeing all the signatures and the global custom rules on the device | Method 1: Signature & Rule Library |
| Seeing the set a vService really works with | Method 2: The vService's OWASP rules screen |
Method 1: Signature & Rule Library Recommended
- How it works The built-in library and the global layer (device-wide changes and global custom rules) appear in a single list.
- Where it is opened Configuration Menu → WAF → Signature & Rule Library
- Requirement WAF license; view permission in the WAF area (full permission in the WAF area to make changes)
- Scope Device-wide; not bound to a vService
Step-by-Step Configuration
1
Adım 1 Open the Configuration Menu
The TR7 logo at the bottom left is clicked; the Configuration Menu opens (how to access).
2
Adım 2 Open the library screen
WAF → Signature & Rule Library is clicked. The Total Active Signatures and Unique Signature Patterns values appear at the top of the screen, and eight summary cards and the rule table appear below them (library summary cards).
3
4
Adım 4 Open the preview of the rule
The row is clicked; the preview opens on the right. The Signature tab shows the ID, type, state, name, description, score, Active Signature Fields (the scopes the rule works in), category and date information; the Classification tab shows CWE, CAPEC, MITRE ATT&CK, MITRE Post-Exploit, OWASP Web, OWASP API and the protected platforms (preview). The pattern of the built-in signatures is not shown. On this screen, the operation icons in the preview title are disabled; the operations are done from the toolbar or from the right-click menu of the row.
Verification
1Top stripTR7 side
The top strip of the screen is examined. When there are no custom rules, the values are 10,370 and 3,347; they change according to the software version and the custom rules.
Expected
Total Active Signatures · Unique Signature PatternsMethod 2: The vService's OWASP rules Screen
- How it works The same table opens in the vService context: the built-in library, the global layer and this vService's layer are shown combined; the Low-scored signatures that the vService's protection level does not scan are marked with a star and subtracted from the numbers.
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → the OWASP Rules link in the signature summary strip
- Requirement WAF protection on in the vService (turning on WAF protection); view permission in the WAF area
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Open the WAF-Protected vServices list
WAF-Protected vServices is selected from the tabs at the top of the Left Monitor Panel. If the vService is not in the list, WAF protection is not on; the protection is turned on first.
2
Adım 2 Open the WAF screen of the vService
The vService is clicked; the screen opens with the Dashboard tab, which carries the name of the vService.
3
Adım 3 Go to the WAF Management tab
The WAF Management tab is clicked. The signature summary strip is located below the mode cards (signature summary strip).
4
Adım 4 Open the OWASP Rules screen
The OWASP Rules → link at the bottom right of the strip is clicked; a closable tab named OWASP Rules opens (how to access). The same tab also opens when the Total Active Signatures row is clicked in the preview panel on the vService's WAF screen. If there are rules specific to this vService (ID 5,000,000 and above), they appear at the end of the list; the Edit, Change State, Restore to Default and Delete operations in the title of the preview that opens when a row is clicked work on this screen.
Verification
1TabTR7 side
The name of the tab that opens next to the WAF Management tab and the Score column are examined.
Expected
The OWASP rules tab; Low* rows at the default Very tight levelCommon Mistakes
- Reading the vService's set from the global screen. The global screen does not show the changes in the vService layer, the vService-specific rules or the effect of the protection level (What is the difference between the vService's OWASP Rules screen and the global Signature & Rule Library screen?).
- Thinking that the view settings are specific to the screen. The hidden column and filter selections are stored per user and are shared by the two screens.
- Looking for the reason the icons in the preview title do not work on the global screen. These icons are enabled only on the vService's OWASP rules screen; on the global screen, the toolbar or the right-click menu is used.
- Looking for a library command in WEB-CLI. There is no signature library command in the
wafcommand group of WEB-CLI; the operations are done from the interface.
How it is done in the documentation
