Configuring system signals

System signals are labels that we've created to describe important, identifiable request properties. The Next-Gen WAF uses them to track requests exhibiting common attacks, anomalies, and behaviors. While detection for most system signals is enabled by default, you must enable detection for CVE virtual patch, API, and ATO system signals if you want to use them.

In addition, you can customize how the Next-Gen WAF handles some system signals by adding:

• Exclusions: configurations that prevent requests with a particular pattern from being tagged with the specified system signal.
• Site alerts (also known as signal thresholds): configurations that cap the number of times requests from the same IP address can be tagged with the same signal before the Next-Gen WAF flags that IP address. Once flagged, subsequent requests from the flagged IP address are handled (e.g., blocked) for a set period of time per the direction of the configuration.

Detections

While detection for most system signals is enabled by default, you must enable detection for CVE virtual patch, API, and ATO system signals if you want to use them.

CVE signals

With CVE signals, you can block and log requests matching specific CVEs. These signals should only be enabled temporarily while you implement more permanent solutions. To enable virtual patches, check out our Virtual patches guide.

ATO and API signals

ATO and API signals can help you gain visibility into registrations, logins, and API requests. ATO signals identify account takeover (ATO) attacks, such as failed password reset attempts. API signals tag requests made to your API, enabling detection of patterns like repeated API requests from an unexpected user agent. With the exception of the Login and Registration groups of signals, ATO and API signals are part of the time series only data storage category.

Detection for API and ATO signals is disabled by default, as configuration is required for enablement. For example, to enable detection of the Login Attempt signal, you must specify the paths of your login endpoints.

Exclusions

Signal exclusions prevent requests with a particular pattern from being tagged with the specified signal. You can use exclusions to help avoid false positives. For example, you could add an exclusion if you don't want requests that are from internal IP addresses and that fail to access the admin login page to be tagged with the FORCEFULBROWSING signal.

To add an exclusion for a system signal, create a signal exclusion rule.

Alternatively, if you're on the Essentials platform and use the Next-Gen WAF control panel, you can add an exclusion by completing the following steps:

1. Log in to the Next-Gen WAF control panel.
2. From the Sites menu, select a site if you have more than one site.
3. Click the Signals tab.
4. On the Signals page, click View next to the appropriate signal.
5. Click the Exclusions tab and then Add exclusion.
6. Fill out the fields in the Conditions section as follows:
   • From the Field menu, select the request field that the condition is based on.
   • In the Value field, enter a value for the specified field.
   • From the Operator menu, select an operator to specify how the selected field and value relate.
   • (Optional) Click Add condition to add another condition, or click Add group to create a group of conditions.
   • Select All to specify that a request must meet every condition to be excluded or Any to specify that a request must meet only one condition to be excluded.
7. Fill out the fields in the Details section as follows:
   • Leave the Status switch enabled.
   • In the Description field, enter a description of the exclusion.
8. Click Create exclusion.

Related content

• Configuring system signals
• Virtual patches for CVEs
• Working with custom signals