Configuring signal thresholds (site alerts)

1. Log in to the Fastly control panel.
2. Go to Security > Next-Gen WAF > Signals.
3. From the workspaces bar, click the menu to the right of the workspace name and select a workspace.

4. Click the document icon next to the appropriate signal.

5. Click Add signal threshold.

   

6. Fill out the Add signal threshold form as follows:

   • In the Name field, enter a descriptive name for the signal threshold.
   • In the Threshold field, enter how many requests containing the signal should be detected before the IP address is flagged.
   • From the Interval menu, select the number of minutes during which signals from the IP address are counted to determine if the threshold has been met.
   • Under When an IP hits the threshold, select whether the threshold should log a sample of subsequent requests from the IP address or block subsequent requests containing attack signals from the IP address. If you selected an anomaly signal from the Signal menu, then you will only be able to log subsequent requests from the IP address. If you're on the Essential platform and selected a CVE signal from the Signal menu, you can only block subsequent requests.
   • From the Duration menu, select how long the IP address should be flagged. By default, IP addresses are flagged for 24 hours. You can set a custom duration by selecting Custom and then setting a duration.
   • Leave the Notifications checkbox selected to send an external notification (e.g., email and Slack) when the signal threshold is triggered. Deselect the checkbox to not send any external notifications.
   • Click the Status switch to enable the signal threshold.

7. Click Add signal threshold.

The steps to add a site alert depend on the platform or packaged offering that you've purchased.

• For the Professional and Premier platforms or a packaged offering, use the Site Alerts page.
• For the Essential platform, use the Signals page.

Site Alerts page

If you're on the Professional or Premier platform or have purchased the Security Core, Security Core Plus, or Security Total packaged offering, complete the following steps:

1. Log in to the Next-Gen WAF control panel.
2. From the Sites menu, select a site if you have more than one site.

3. From the Rules menu, select Site Alerts.

4. Click Add site alert.

   

5. Fill out the Add form as follows:

   • In the Long name field, enter a descriptive name for the alert.
   • From the Signal menu, select the signal that the site alert should track.
   • In the Threshold field, enter how many requests containing the signal should be detected before the IP address is flagged.
   • From the Interval menu, select the number of minutes during which signals from the IP address are counted to determine if the threshold has been met.
   • Under When an IP hits the threshold, select whether the alert should log a sample of subsequent requests from the IP address or block subsequent requests containing attack signals from the IP address. If you selected an anomaly signal from the Signal menu, then you will only be able to log subsequent requests from the IP address.
   • Under Take action for, select how long the IP address should be flagged. By default, IP addresses are flagged for 24 hours. You can set a custom duration by selecting Custom duration and choosing a duration.
   • Leave the Notifications checkbox selected to send an external notification (e.g., email and Slack) when the site alert is triggered. Deselect the checkbox to not send any external notifications.
   • Click the Status switch to enable the site alert.

6. Click Save alert.

Signals page

If you're on the Essential platform, complete the following steps:

1. Log in to the Next-Gen WAF control panel.
2. From the Sites menu, select a site if you have more than one site.

3. Click the Signals tab.

4. On the Signals page, click View in the row of the CVE signal that you want to enable.

5. Click the Configuration tab.

6. Click the Alerts tab and then Add alert.

7. Fill out the alert fields as follows:

   • In the Long name field, enter a descriptive name for the alert.
   • In the Threshold field, enter how many requests containing the signal should be detected before the IP address is flagged.
   • From the Interval menu, select the number of minutes during which signals from the IP address are counted to determine if the threshold has been met.
   • Under When an IP hits the threshold, select whether the alert should log subsequent requests or block subsequent requests containing attack signals from the IP address. For CVE signals, you can only block subsequent requests.
   • Under Take action for, select how long the IP address should be flagged. By default, IP addresses are flagged for 24 hours. You can set a custom duration by selecting Custom duration and choosing a duration.
   • Leave the Notifications checkbox selected to send an external notification (e.g., email and Slack) when the site alert is triggered. Deselect the checkbox to not send any external notifications.
   • Click the Status switch to enable the site alert.

8. Click Save alert.

1. Log in to the Fastly control panel.
2. Go to Security > Next-Gen WAF > Signals.
3. From the workspaces bar, click the menu to the right of the workspace name and select a workspace.

4. Click the document icon next to the appropriate signal.

5. Click the Configuration tab and then the Thresholds tab.

6. Click the pencil to the right of the signal threshold that you want to edit.

   

7. Fill out the Edit signal threshold form as follows:

   • In the Name field, enter a descriptive name for the signal threshold.
   • In the Threshold field, enter how many requests containing the signal should be detected before the IP address is flagged.
   • From the Interval menu, select the number of minutes during which signals from the IP address are counted to determine if the threshold has been met.
   • Under When an IP hits the threshold, select whether the threshold should log a sample of subsequent requests from the IP address or block subsequent requests containing attack signals from the IP address. If you selected an anomaly signal from the Signal menu, then you will only be able to log subsequent requests from the IP address. If you're on the Essential platform and selected a CVE signal from the Signal menu, you can only block subsequent requests.
   • From the Duration menu, select how long the IP address should be flagged. By default, IP addresses are flagged for 24 hours. You can set a custom duration by selecting Custom and then setting a duration.
   • Leave the Notifications checkbox selected to send an external notification (e.g., email and Slack) when the signal threshold is triggered. Deselect the checkbox to not send any external notifications.
   • Click the Status switch to the On position to enable the signal threshold or the Off position to disable the signal threshold.

8. Click Update signal threshold.

The steps to edit a site alert depend on the platform or packaged offering that you've purchased.

• For the Professional and Premier platforms or a packaged offering, use the Site Alerts page.
• For the Essential platform, use the Signals page.

Site Alerts page

If you're on the Professional or Premier platform or have purchased the Security Core, Security Core Plus, or Security Total packaged offering, complete the following steps:

1. Log in to the Next-Gen WAF control panel.
2. From the Sites menu, select a site if you have more than one site.

3. From the Rules menu, select Site Alerts.

4. Click the name of the site alert that you want to edit.

5. Click Edit site alert.

6. Fill out the Edit form as follows:

   • In the Long name field, enter a descriptive name for the alert.
   • From the Signal menu, select the signal that the site alert should track.
   • In the Threshold field, enter how many requests containing the signal should be detected before the IP address is flagged.
   • From the Interval menu, select the number of minutes during which signals from the IP address are counted to determine if the threshold has been met.
   • Under When an IP hits the threshold, select whether the alert should log a sample of subsequent requests from the IP address or block subsequent requests containing attack signals from the IP address. If you selected an anomaly signal from the Signal menu, then you will only be able to log subsequent requests from the IP address.
   • Under Take action for, select how long the IP address should be flagged. By default, IP addresses are flagged for 24 hours. You can set a custom duration by selecting Custom duration and choosing a duration.
   • Leave the Notifications checkbox selected to send an external notification (e.g., email and Slack) when the site alert is triggered. Deselect the checkbox to not send any external notifications.
   • Click the Status switch to the On position to enable the site alert or the Off position to disable the site alert.

7. Click Save alert.

Signals page

If you're on the Essential platform, complete the following steps:

1. Log in to the Next-Gen WAF control panel.
2. From the Sites menu, select a site if you have more than one site.

3. Click the Signals tab.

4. On the Signals page, click View in the row of the CVE signal that you want to enable.

5. Click the Configuration tab and then the Alerts tab.

6. Click the name of the site alert that you want to modify.

7. Click Edit alert.

8. Fill out the alert fields as follows:

   • In the Long name field, enter a descriptive name for the alert.
   • In the Threshold field, enter how many requests containing the signal should be detected before the IP address is flagged.
   • From the Interval menu, select the number of minutes during which signals from the IP address are counted to determine if the threshold has been met.
   • Under When an IP hits the threshold, select whether the alert should log subsequent requests or block subsequent requests containing attack signals from the IP address. For CVE signals, you can only block subsequent requests.
   • Under Take action for, select how long the IP address should be flagged. By default, IP addresses are flagged for 24 hours. You can set a custom duration by selecting Custom duration and choosing a duration.
   • Leave the Notifications checkbox selected to send an external notification (e.g., email and Slack) when the site alert is triggered. Deselect the checkbox to not send any external notifications.
   • Click the Status switch to the On position to enable the site alert or the Off position to disable the site alert.

9. Click Save alert.

1. Log in to the Fastly control panel.
2. Go to Security > Next-Gen WAF > Signals.
3. From the workspaces bar, click the menu to the right of the workspace name and select a workspace.
4. Click the document icon next to the appropriate signal.
5. Click the Configuration tab and then the Thresholds tab.
6. Click the trash next to the signal threshold that you want to delete and then Delete signal threshold.

The steps to delete a site alert depend on the platform or packaged offering that you've purchased.

• For the Professional and Premier platforms or a packaged offering, use the Site Alerts page.
• For the Essential platform, use the Signals page.

Site Alerts page

If you're on the Professional or Premier or have purchased the Security Core, Security Core Plus, or Security Total packaged offering, complete the following steps:

1. Log in to the Next-Gen WAF control panel.
2. From the Sites menu, select a site if you have more than one site.
3. From the Rules menu, select Site Alerts.
4. Click the name of the site alert that you want to delete.
5. Click Remove site alert and then Delete.

Signals page

If you're on the Essential platform, complete the following steps:

1. Log in to the Next-Gen WAF control panel.
2. From the Sites menu, select a site if you have more than one site.
3. Click the Signals tab.
4. On the Signals page, click View in the row of relevant signal.
5. Click Configuration and then Alerts.
6. Click the name of the site alert that you want to delete.
7. Click Remove alert and then Delete.