Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?
Short answer
These mappings are seen in three places. On the Signature & Rule Library screen, the Classification tab of the preview that opens when a row is clicked lists the CWE, CAPEC, MITRE ATT&CK, MITRE Post-Exploit, OWASP Web Coverage, OWASP API Coverage and Protected Targets mappings of the rule in the "ID · name" form; rows with no value are not shown. With Columns, the CWE, CAPEC, MITRE ATT&CK, MITRE Post-Exploit, OWASP Web Coverage, OWASP API Coverage, Protected Targets and Signature Category columns, which are hidden by default, are added to the table. For the reverse, an item from the related group (e.g. A03:2021 or CWE-89) is selected in the Filter window and all the rules mapped to that item are listed. In custom rules, these fields are empty. The same classification is also used in Event Logs records and in reports.
Problem: The Mapping of a Signature in the Standards Is Needed
For a compliance report or a threat analysis, the aim is to see to which OWASP item, CWE weakness, CAPEC attack pattern and MITRE ATT&CK technique a signature is mapped; or, conversely, which signatures cover a certain item.
Solution: Three Methods
| Your situation | Suitable method |
|---|---|
| Seeing all the mappings of a single rule | Method 1: Classification tab |
| Seeing the mappings side by side with the rules in the list, or exporting them | Method 2: Classification columns |
| Finding the rules that cover an item | Method 3: Filter |
Method 1: Classification Tab Recommended
- How it works All the classification fields of the selected rule are listed on the second tab of the preview.
- Where it is opened Signature & Rule Library or the OWASP Rules screen of the vService → row → Classification
- Requirement WAF license; view permission in the WAF area
- Scope Device-wide
Step-by-Step Configuration
1
Adım 1 Open the library screen
The Configuration Menu is opened with the TR7 logo at the bottom left and WAF → Signature & Rule Library is clicked (how to access). Since only viewing will be done, full permission is not required.
2
Adım 2 Find the rule
The ID or the name of the rule is written in the Search field. The ID of an attack that comes from Event Logs is in the Attack ID row on the Attacks tab of the record.
3
Adım 3 Open the preview
The row is clicked; on the right, the preview opens with the Signature tab.
4
Adım 4 Switch to the Classification tab
The Classification tab is clicked. The CWE, CAPEC, MITRE ATT&CK, MITRE Post-Exploit, OWASP Web Coverage and OWASP API Coverage values appear in the "ID · name" form (e.g. CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), and the Protected Targets values appear as names. Rows that carry no value in the rule are not listed; the attack category is in the Signature Category row on the Signature tab.
Verification
1PreviewTR7 side
The rows on the Classification tab are examined.
Expected
The CWE · CAPEC · MITRE · OWASP · Protected Targets values the rule carriesMethod 2: Classification Columns
- How it works Nine columns that are hidden by default are added to the table; search and export can be done together with these columns.
- Where it is opened Signature & Rule Library or the OWASP Rules screen of the vService → Columns
- Requirement View permission in the WAF area
- Scope View setting; stored per user
Step-by-Step Configuration
1
Adım 1 Open the column selector
Columns on the toolbar is clicked.
2
Adım 2 Check the columns
Signature Category, CWE, CAPEC, MITRE ATT&CK, MITRE Post-Exploit, Protected Targets, OWASP Web Coverage and OWASP API Coverage are checked; if needed, Type is also added. The selection is stored per user and is common to the two screens. In the CWE, OWASP Web Coverage and OWASP API Coverage columns, only the IDs appear; in the CAPEC and MITRE columns, "ID · name" appears.
Verification
1TableTR7 side
The column headers of the table are examined.
Expected
CWE · CAPEC · MITRE ATT&CK · OWASP Web Coverage columnsMethod 3: Filter
- How it works When a standard item is selected, the list narrows to only the rules mapped to that item; items selected from the same group are joined with "or", and those selected from different groups with "and".
- Where it is opened Signature & Rule Library or the OWASP Rules screen of the vService → Filter
- Requirement View permission in the WAF area
- Scope View setting; stored per user
Step-by-Step Configuration
1
Adım 1 Open the filter window
Filter on the toolbar is clicked.
2
Adım 2 Select the group and the item
An item is selected in the OWASP Web Coverage, OWASP API Coverage, CWE Coverage, CAPEC Coverage, MITRE ATT&CK Coverage or Protected Target Types group (e.g. OWASP Web Coverage → A03:2021). The number next to the options is the number of signatures (rule × scope). The MITRE ATT&CK Coverage group lists the techniques during the attack and after the attack together.
Verification
1Filter titleTR7 side
The number next to the selected item and the list are examined; on the device-wide screen, while there is no custom rule, 5,151 (signatures) is written next to the A03:2021 option and the list narrows to 1,698 rules. The Total Active Signatures and Unique Signature Patterns values in the title of the filter area do not change with the filter selection.
Expected
Only the rules mapped to the selected itemCommon Mistakes
- Expecting a classification in a custom rule. Custom rules are written to the Custom Rules category; the CWE, CAPEC, MITRE ATT&CK, OWASP and protected platform fields cannot be entered manually and stay empty.
- Searching for the value of a hidden column with Search. Search works on the values seen on the screen; first, the related column is opened with Columns.
- Looking for the log-side filter on this screen. Event Logs has its own Category, CWE, MITRE ATT&CK, CAPEC, OWASP Web, OWASP API and Target filters (How do I filter logs by fields such as IP, country, ASN, path, signature, category, OWASP and CWE?).
How it is done in the documentation
