Working with templated rules
Templated rules are partially pre-constructed rules that can help you protect against Common Vulnerabilities and Exposures (CVE) and gain visibility into registrations, logins, and API requests. For example, you can enable the GraphQL API Query templated rule to track GraphQL API requests.
Types of templated rules
There are three types of templated rules.
Virtual patching rules
Virtual patching rules block or log requests matching specific vulnerabilities. These can be configured to send an alert after a threshold of matching requests. New virtual patching rules are announced through an optional email subscription. You can subscribe to virtual patching announcements in your account settings.
API protection rules
API protection rules tag requests made to your API, allowing you to detect patterns such as repeated API requests from an unexpected user agent. API Protection signals are informational, so only certain requests tagged with these signals will appear in the requests page of the control panel. See Storage categories for additional details.
ATO protection rules
ATO protection rules enable you to quickly create rules to identify account takeover (ATO) attacks, such as failed password reset attempts. With the exception of the Login and Registration groups of signals, ATO Protection signals are informational, so only certain requests tagged with these signals will appear in the requests page of the control panel. See Storage categories for additional details.
Enabling and editing templated rules
To enable and edit templated rules, complete the following steps:
Log in to the Next-Gen WAF control panel.
From the Sites menu, select a site if you have more than one site.
From the Site Rules menu, select Templated Rules.
Click View to the right of the rule you want to enable or edit.
Click Configure in the upper-right corner to enable or edit the rule.
In the condition-related fields, enter values specific to your application, such as paths, response codes, and headers. It is possible to add, edit, and remove conditions in the rule as necessary for your application.
(Optional) If the Configure thresholds and actions section is available, select the action that should be taken (e.g., block or log).
When configuring failure-based rules (e.g.,
Login Failure), you can also optionally define the:- threshold, the parameters that define how often an individual client can send requests that meet the rule's conditions before action is taken.
- duration, the amount of time the action will occur.
- notifications, whether notification should be sent via your site (also known as workspace) integrations.
Click Update Rule or Update Site Rule.
