Glossary
- English
- 日本語
This glossary defines terms used throughout the Next-Gen WAF documentation.
| Term | Definition | |
|---|---|---|
| Admin role | A user role that can access the Next-Gen WAF control panel. Users with this role have limited access to account (corp) configurations, can edit specific workspaces (sites), and can invite users to workspaces (sites). This role is equivalent to the Next-Gen WAF Admin role in the Fastly control panel. | |
| Advanced rate limiting rule | A type of Next-Gen WAF rule that allows you to define how the WAF should handle requests from individual clients that exhibit repeat, abnormal behavior. For instance, you can rate limit requests to your web application's login page to deter account takeover attempts. If an IP address generates excessive failed logins, suggesting a brute-force attack, the rule will temporarily block that IP address from accessing the login path. | |
| Agent alert | Custom alerts for the Next-Gen WAF that trigger whenever the number of online agents reaches a user-specified threshold or the average number of requests per second (RPS) for all agents across all workspaces (sites) reaches a user-specified threshold. | |
| Allow | A Next-Gen WAF agent decision to allow a request to proceed to your origin servers. | |
| Anomaly signal | A Next-Gen WAF label that describes abnormal requests. While not inherently malicious, abnormal requests may be indicative of unwanted or abusive traffic. Examples include malformed request data and requests originating from known scanners. | |
| API access token | Permanent tokens used to access the Next-Gen WAF API. Users can connect to the API using their email and access token. | |
| API token | Unique security credentials that allow human users and automated systems to prove their identity to Fastly, thereby indicating they can be trusted to access restricted resources and perform specific, restricted operations via the Fastly API. | |
| Attack signal | A Next-Gen WAF label that describes malicious requests that contain payloads designed to hack, destroy, disable, steal, gain unauthorized access, and otherwise take harmful actions against your workspaces (sites). | |
| Blocking | A Next-Gen WAF protection mode (agent mode) that tells the WAF to block malicious requests from reaching your web servers. Blocking mode still allows legitimate traffic. | |
| Cloud engine | One of the main components of the Next-Gen WAF architecture. The cloud engine collects metadata and logs and sends rule configuration data to the agents. | |
| Corp (corporation or account) | A company hub for the Next-Gen WAF for adding and deleting workspaces (sites), applying configurations across multiple workspaces (sites), and controlling user access. Users are authenticated against a corp (account) and can be members of different workspaces (sites) in that corp (account). | |
| Deception action | A Next-Gen WAF action that returns a deceptive response to attackers, making them unsure whether their attack was successful. | |
| Event | Action that the Next-Gen WAF takes as the result of attack thresholds, enabled CVE, API, and ATO signals, and site alerts (signal thresholds). This includes any occurrence that happens on the Events page, such as a flagged IP address. Events are automatically system generated. | |
| Flagged IP address | An IP address that the Next-Gen WAF flags for exceeding thresholds. | |
| Header link | External data like Kibana or Datadog that connects with request data from the Next-Gen WAF. | |
| Integration (alert) | DevOps toolchain app that sends Next-Gen WAF activity notifications to users. Examples include Slack, Datadog, PagerDuty, mailing lists, and generic webhooks. | |
| IP anonymization | Converting IP addresses to anonymous IPv6 addresses so that the Next-Gen WAF will not know the actual IP addresses. This causes the IP addresses to appear anonymous in the control panel. | |
| List | Sets of custom data used in Next-Gen WAF rules, such as a list of countries your company doesn't do business with. Lists can be made up of countries, IP addresses, strings, and wildcards. | |
| Logging (Not Blocking) | A Next-Gen WAF protection mode (agent mode) that tells the WAF to monitor and log requests only, never blocking traffic even when requests match rules with a block action. | |
| Monitor view | The site dashboards in the Next-Gen WAF control panel in a TV-friendly format. | |
| Next-Gen WAF | A web application firewall that provides real-time threat detection and attack mitigation for your web applications and origin servers. | |
| Next-Gen WAF Admin role | A user role that can access the Next-Gen WAF in the Fastly control panel. Users with this role have limited access to account (corp) configurations, can edit specific workspaces (sites), and can invite users to workspaces (sites). This role is equivalent to the Admin role in the Next-Gen WAF control panel. | |
| Next-Gen WAF agent | One of the main components of the Next-Gen WAF architecture. The agent is responsible for processing requests and communicating with our cloud engine. If your deployment does not use the optional module component, the agent also performs the role of the module. | |
| Next-Gen WAF module | One of the main components of the Next-Gen WAF architecture. The module receives and passes requests to the agent. It then enforces the agent's decisions to allow, log, block, or deceive those requests. | |
| Next-Gen WAF Observer role | A user role that can access the Next-Gen WAF in the Fastly control panel. Users with this role can view workspaces (sites) they are assigned to but cannot edit any configurations. This role is equivalent to the Observer role in the Next-Gen WAF control panel. | |
| Next-Gen WAF Owner role | A user role that can access the Next-Gen WAF in the Fastly control panel. Users with this role have access to all account (corp) configurations, can edit every workspace (site), and can manage users. This role is equivalent to the Owner role in the Next-Gen WAF control panel. | |
| Next-Gen WAF User role | A user role that can access the Next-Gen WAF in the Fastly control panel. Users with this role can edit workspace (site) configurations on workspaces (sites) they are assigned to. This role is equivalent to the User role in the Next-Gen WAF control panel. | |
| Observer role | A user role that can access the Next-Gen WAF control panel. Users with this role can view workspaces (sites) they are assigned to but cannot edit any configurations. This role is equivalent to the Next-Gen WAF Observer role in the Fastly control panel. | |
| Off | A Next-Gen WAF protection mode (agent mode) that disables request processing. Traffic is no longer sent to the Next-Gen WAF. | |
| Owner role | A user role that can access the Next-Gen WAF control panel. Users with this role have access to all account (corp) configurations, can edit every workspace (site), and can manage users. This role is equivalent to the Next-Gen WAF Owner role in the Fastly control panel. | |
| Protection mode (agent mode) | A Next-Gen WAF setting that determines whether the WAF should block malicious requests, not block malicious requests, or entirely disable request processing. | |
| Redaction | Sensitive data that is not sent to the Next-Gen WAF backend for privacy reasons. By default, the WAF redacts some sensitive data, such as credit card numbers and social security numbers. Users can specify their own custom redactions. | |
| Request | Information that is sent from the client to the server over the hypertext transfer protocol (HTTP). | |
| Request rule | A type of Next-Gen WAF rule that allows you to define arbitrary conditions that requests must meet in order for the WAF to take action and the actions the WAF should take when the conditions are met. For example, you could make a rule to block all requests with specific headers, requests to certain paths, or requests originating from specific IP addresses. | |
| Response time | The amount of time between when a request was received by the server and when the server generated a response. | |
| Rule | A Next-Gen WAF configuration that defines what should happen to requests when they meet certain conditions (e.g., block or rate limit). | |
| Sampling | A Next-Gen WAF data storage method that captures individual request data from a representative number of requests that were tagged with anomaly signals, bot signals, and custom signals not used in advanced rate limiting rules. | |
| Signal | A label that describes important, identifiable request properties. Depending on the payload, the Next-Gen WAF may tag a single request with multiple signals. The Next-Gen WAF relies on signals to help determine which requests to log and block and they can help increase visibility into your traffic. | |
| Signal exclusion rule | A type of Next-Gen WAF rule that allows you to define arbitrary conditions to prevent requests from being tagged with certain signals. Signal exclusion rules help prevent false positives. For example, let's say you have an internal CMS where employees can post raw HTML. If employees try to post raw HTML that look like a Cross-Site Scripting (XSS) attack, their requests might get tagged with the XSS system signal and then blocked. To prevent false positives and your well-meaning employees from being accidentally blocked, you could create a signal exclusion rule to prevent requests that are coming from your VPN IP and post HTML from being tagged with the XSS signal. | |
| Site | A user-defined collection of rules and settings that govern how the Next-Gen WAF processes and handles incoming requests to your web application or origin server. Using this collection of rules and settings, you can adjust the protection of your web application or origin server, ensuring the WAF blocks malicious traffic and allows legitimate requests. | |
| Suspicious IP address | IP address that is approaching Next-Gen WAF thresholds but has not yet met or exceeded them. | |
| Templated rule | A type of Next-Gen WAF rule that is partially pre-constructed and associated with an API, ATO, or CVE virtual patch signal. Templated rules allow you to quickly enable protections by filling in required fields rather than building rules from scratch. Use them to track API requests (API signals), monitor logins and registrations (ATO signals), or temporarily shield against known vulnerabilities (CVE virtual patch signals). | |
| Threshold configuration | A Next-Gen WAF configuration that defines how to handle requests from sources (e.g., IP addresses) that exhibit repeat, abnormal behavior. | |
| User role | A user role that can access the Next-Gen WAF control panel. Users with this role can edit workspace (site) configurations on workspaces (sites) they are assigned to. This role is equivalent to the Next-Gen WAF User role in the Fastly control panel. | |
| Virtual patch | A pre-constructed Next-Gen WAF rule that defends against a specific Common Vulnerability and Exposure (CVE) by identifying requests that match known exploit patterns and blocking them before they reach your web application. Enable virtual patches to gain immediate protection against newly discovered vulnerabilities while you work on a permanent remediation. | |
| Workspace (site) | A user-defined collection of rules and settings that govern how the Next-Gen WAF processes and handles incoming requests to your web application or origin server. Using this collection of rules and settings, you can adjust the protection of your web application or origin server, ensuring the WAF blocks malicious traffic and allows legitimate requests. |
