Working with signal exclusion rules
- English
- 日本語
A signal exclusion rule prevents requests with a particular pattern from being tagged with a specific system signal. You can use signal exclusion rules to help avoid false positives. For example, you may have an internal website where you allow employees to POST raw HTML. These types of requests may look like a Cross-Site Scripting attack (XSS) and get tagged with the XSS system signal by the Next-Gen WAF. To prevent false positives, you can create a signal exclusion rule to prevent requests from your internal VPN on that website from being tagged with the xss attack signal. Similarly, a signal exclusion rule could prevent internal IP addresses that fail to access an admin page from being tagged with the FORCEFULBROWSING signal.
Limitations and considerations
When working with signal exclusion rules, keep the following in mind:
- Signal exclusion rules are limited to 1000 at the account-level (also known as corp-level) plus 1000 at the site-level (also known as workspace-level) and count against the total number of request rule limits for accounts (corps) and workspaces (sites).
- Not all system signals are available for use in signal exclusion rules. For more information on which system signals are usable, refer to the system signals documentation.
Creating signal exclusion rules
You can create signal exclusion rules that apply to multiple workspaces (sites) or that only apply to a single workspace (site).
Creating signal exclusion rules that apply to multiple workspaces (sites)
To create a signal exclusion rule that applies to multiple workspaces (sites), complete the following steps:
- Fastly control panel
- Next-Gen WAF control panel
- Log in to the Fastly control panel.
- Go to Security > Next-Gen WAF > Rules.
- From the workspaces bar, click the menu
to the right of the workspace name and select your account name. Click Add account rule.
In the Type section, select Signal.
Fill out the fields in the Conditions section as follows:
- Select All to specify that a request must meet every condition to be excluded or Any to specify that a request must meet only one condition to be excluded.
- From the Field menu, select the request field that the condition is based on.
- From the Operator menu, select an operator to specify how the selected field and value relate.
- In the Value field, enter a value for the specified field.
- (Optional) Click Add condition to add another condition, or click Add group to create a group of conditions.
In the Actions section, use the Signal menu to select the signal that you want to prevent from being assigned to requests that meet specific conditions.
Fill out the fields in the Details section as follows:
- In the Description field, enter a description of the rule.
- Leave the Status switch enabled.
- From the Scope menu, leave Global selected for the rule to apply to all your workspaces. If you want the rule to apply to specific workspaces, select Specified workspaces and then select the workspaces the rule should apply to.
Click Create account rule.
Creating signal exclusion rules that apply to one workspace (site)
To create a signal exclusion rule that applies to only one workspace (site), complete the following steps:
- Fastly control panel
- Next-Gen WAF control panel
- Log in to the Fastly control panel.
- Go to Security > Next-Gen WAF > Rules.
- From the workspaces bar, click the menu to the right of the workspace name and select a workspace.
Click Add workspace rule.
In the Type section, select Signal exclusion.
From the Signal menu, select the signal that you want to prevent from being assigned to requests that meet specific conditions.
Fill out the fields in the Conditions section as follows:
- From the Field menu, select the request field that the condition is based on.
- In the Value field, enter a value for the specified field.
- From the Operator menu, select an operator to specify how the selected field and value relate.
- (Optional) Click Add condition to add another condition, or click Add group to create a group of conditions.
- Leave All selected to specify that a request must meet every condition to be excluded or select Any to specify that a request must meet only one condition to be excluded.
In the Action section, leave Exclude signal selected for the Type menu.
Fill out the fields in the Details section as follows:
- In the Description field, enter a description of the rule.
- Leave the Status switch enabled.
Click Add workspace rule. The rule is created, and the Rules page appears.
Editing signal exclusion rules
The steps to edit an existing rule depends on whether the rule applies to multiple workspaces (sites) or to a single workspace (site).
HINT: Not sure if your rule logic will work? Use our Simulator to test it.
Editing signal exclusion rules that apply to multiple workspaces (sites)
To adjust a signal exclusion rule that applies to more than one workspace (site), complete the following steps:
- Fastly control panel
- Next-Gen WAF control panel
- Log in to the Fastly control panel.
- Go to Security > Next-Gen WAF > Rules.
- From the workspaces bar, click the menu to the right of the workspace name and select your account name.
Click the pencil
to the right of the rule that you want to modify.
Fill out the fields in the Conditions section as follows:
- Select All to specify that a request must meet every condition to be excluded or Any to specify that a request must meet only one condition to be excluded.
- From the Field menu, select the request field that the condition is based on.
- From the Operator menu, select an operator to specify how the selected field and value relate.
- In the Value field, enter a value for the specified field.
- (Optional) Click Add condition to add another condition, or click Add group to create a group of conditions.
In the Actions section, use the Signal menu to select the signal that you want to prevent from being assigned to requests that meet specific conditions.
Fill out the fields in the Details section as follows:
- In the Description field, enter a description of the rule.
- Leave the Status switch enabled.
- From the Scope menu, leave Global selected for the rule to apply to all your workspaces. If you want the rule to apply to specific workspaces, select Specified workspaces and then select the workspaces the rule should apply to.
Click Update account rule.
Editing signal exclusion rules that apply to one workspace (site)
To adjust a signal exclusion rule that applies to only one workspace (site), complete the following steps:
- Fastly control panel
- Next-Gen WAF control panel
- Log in to the Fastly control panel.
- Go to Security > Next-Gen WAF > Rules.
- From the workspaces bar, click the menu to the right of the workspace name and select a workspace.
Click the pencil
to the right of the rule that you want to modify.
From the Signal menu, select the signal that you want to prevent from being assigned to requests that meet specific conditions.
Fill out the fields in the Conditions section as follows:
- From the Field menu, select the request field that the condition is based on.
- In the Value field, enter a value for the specified field.
- From the Operator menu, select an operator to specify how the selected field and value relate.
- (Optional) Click Add condition to add another condition, or click Add group to create a group of conditions.
- Select All to specify that a request must meet every condition to be excluded or Any to specify that a request must meet only one condition to be excluded.
Fill out the fields in the Details section as follows:
- In the Description field, enter a description of the rule.
- Leave the Status switch enabled.
Click Update workspace rule. The rule is updated, and the Rules page appears.
Deleting signal exclusion rules
To delete a signal exclusion rule, follow the steps described in the Deleting rules section.
