diff --git a/docs/wafd/umn/en-us_image_0000002395335841.png b/docs/wafd/umn/en-us_image_0000002395335841.png deleted file mode 100644 index b418f2611..000000000 Binary files a/docs/wafd/umn/en-us_image_0000002395335841.png and /dev/null differ diff --git a/docs/wafd/umn/en-us_image_0000002483843449.png b/docs/wafd/umn/en-us_image_0000002483843449.png new file mode 100644 index 000000000..3954184ae Binary files /dev/null and b/docs/wafd/umn/en-us_image_0000002483843449.png differ diff --git a/docs/wafd/umn/waf_01_0024.html b/docs/wafd/umn/waf_01_0024.html index 8f218c1a1..70b02378e 100644 --- a/docs/wafd/umn/waf_01_0024.html +++ b/docs/wafd/umn/waf_01_0024.html @@ -4,7 +4,7 @@

If you are sure that a protection event is a false alarm (no malicious link or character was detected), you can handle it as a false alarm, add the client IP address to an address group that is allowed by the policy, add the client IP address to a blacklist/whitelist rule, or disable or delete the hit protection rule. Events that have been handled as false alarms will not be displayed in the event list.

Scenarios

If legitimate service requests are blocked by WAF, the website may be inaccessible to some visitors. For example, after you connect a web service deployed on ECSs to WAF over its public domain name and enable basic web protection for it, if its normal traffic hits a protection rule, the access requests will be blocked. The web service becomes inaccessible over the domain name or returns errors to visitors, but it is still accessible over server IP addresses. It is more likely that the requests were blocked mistakenly, and the event is a false alarm. In this case, you need to handle the event as a false alarm.

You can handle false alarms in the following ways based on how they were generated:

-
@@ -13,9 +13,9 @@

Constraints

Handling False Alarms Triggered by Protection Rules

If you are sure that an event is a false alarm generated based on a WAF built-in rule or custom protection rule, you can handle the event as a false alarm.

- +
  1. Log in to the management console.
  2. Click in the upper left corner and select a region or project.
  3. Click in the upper left corner and choose Web Application Firewall (Dedicated) under Security.
  4. In the navigation pane on the left, click Events.
  5. View protection details of a specified domain name, instance, and time range.
  6. Locate the target protection event and choose More > Handle as False Alarm in the Operation column.
  7. In the Handle False Alarm dialog box, handle the event.

    • Ignore the corresponding WAF protection based on the request features hit the rule.

      If a protection event is triggered by a rule in Basic Web Protection or Feature-based Anti-Crawler, the associated request features will be displayed in the Handle False Alarm dialog box by default. You need to ignore the corresponding WAF protection type and click OK. For details about the parameters of the global whitelist rule, see Table 1.

      -
      Figure 1 Handle False Alarm
      +
      Figure 1 Handle False Alarm
      @@ -149,7 +149,7 @@ -
      Table 1 Parameters

      Parameter

      Known Attack Source

      If you select Block for Protective Action, you can configure a known attack source rule. Then, WAF blocks the requests matching the configured IP, Cookie, or Params for a period configured by the known attack source rule. For details about know attack source rules, see Configuring a Known Attack Source Rule to Block Specific Visitors for a Specified Duration.

      +

      If you select Block for Protective Action, you can configure a known attack source rule. Then, WAF blocks the requests matching the configured IP, Cookie, or Params for a period configured by the known attack source rule. For details about known attack source rules, see Configuring a Known Attack Source Rule to Block Specific Visitors for a Specified Duration.

      Rule Description

      diff --git a/docs/wafd/umn/waf_01_0045.html b/docs/wafd/umn/waf_01_0045.html index b9fe700a9..25d9c0356 100644 --- a/docs/wafd/umn/waf_01_0045.html +++ b/docs/wafd/umn/waf_01_0045.html @@ -2,13 +2,13 @@

      What Is WAF?

      Web Application Firewall (WAF) keeps web services stable and secure. It examines all HTTP and HTTPS requests to detect and block the following attacks: Structured Query Language (SQL) injection, cross-site scripting (XSS), web shells, command and code injections, file inclusion, sensitive file access, third-party vulnerability exploits, Challenge Collapsar (CC) attacks, malicious crawlers, and cross-site request forgery (CSRF).

      -

      After you enable a WAF instance,you still need to add your website domain to the WAF instance on the WAF console. All public network traffic for your website then goes to WAF first. WAF identifies and filters out the illegitimate traffic, and routes only the legitimate traffic to your origin server to ensure site security.

      +

      After you enable a WAF instance, you still need to add your website domain to the WAF instance on the WAF console. All public network traffic for your website then goes to WAF first. WAF identifies and filters out the illegitimate traffic, and routes only the legitimate traffic to your origin server to ensure site security.

      How WAF Works (Dedicated Mode)

      After applying for WAF, add the website to WAF on the WAF console. After a website is connected to WAF, all website access requests are forwarded to WAF first. WAF detects and filters out malicious attack traffic, and returns normal traffic to the origin server to ensure that the origin server is secure, stable, and available.

      Figure 1 How WAF Works

      The process of forwarding traffic from WAF to origin servers is called back-to-source. WAF uses back-to-source IP addresses to send client requests to the origin server. When a website is connected to WAF, the destination IP addresses to the client are the IP addresses of WAF, so that the origin server IP address is invisible to the client.

      Figure 2 Back-to-source IP address
      -

      How WAF Works (ELB Access Mode)

      If you connect a website to WAFELB access mode, WAF works as follows:

      +

      How WAF Works (ELB Access Mode)

      If you connect a website to WAF ELB access mode, WAF works as follows:

      • In this mode, WAF is integrated into the gateway of an ELB load balancer through an SDK module. WAF extracts traffic through the SDK module embedded in the gateway for inspection.
      • WAF synchronizes the inspection result to the load balancer, and the load balancer determines whether to forward client requests to the origin server based on the inspection result.
      • In this method, WAF does not forward traffic. This reduces compatibility and stability problems.
      Figure 3 How WAF in ELB load balancer access mode works
      diff --git a/docs/wafd/umn/waf_01_0128.html b/docs/wafd/umn/waf_01_0128.html index d719f2784..00518a34c 100644 --- a/docs/wafd/umn/waf_01_0128.html +++ b/docs/wafd/umn/waf_01_0128.html @@ -3,7 +3,7 @@

      Can I Access a Website Using an IP Address After a Domain Name Is Connected to WAF?

      After a domain name is connected to WAF, you can enter the origin server IP address in the address bar of the browser to access the website. However, your origin server IP address is easily exposed. As a result, attackers can bypass WAF and attack your origin server.

      Web Application Firewall (WAF) keeps web services stable and secure. It examines all HTTP and HTTPS requests to detect and block the following attacks: Structured Query Language (SQL) injection, cross-site scripting (XSS), web shells, command and code injections, file inclusion, sensitive file access, third-party vulnerability exploits, Challenge Collapsar (CC) attacks, malicious crawlers, and cross-site request forgery (CSRF).

      -

      After you enable a WAF instance,you still need to add your website domain to the WAF instance on the WAF console. All public network traffic for your website then goes to WAF first. WAF identifies and filters out the illegitimate traffic, and routes only the legitimate traffic to your origin server to ensure site security.

      +

      After you enable a WAF instance, you still need to add your website domain to the WAF instance on the WAF console. All public network traffic for your website then goes to WAF first. WAF identifies and filters out the illegitimate traffic, and routes only the legitimate traffic to your origin server to ensure site security.

      diff --git a/docs/wafd/umn/waf_01_0169.html b/docs/wafd/umn/waf_01_0169.html index 829eb8f73..084a150d6 100644 --- a/docs/wafd/umn/waf_01_0169.html +++ b/docs/wafd/umn/waf_01_0169.html @@ -435,7 +435,7 @@
-

Impact on the System

diff --git a/docs/wafd/umn/waf_01_1172.html b/docs/wafd/umn/waf_01_1172.html index 0e5022b8f..1d50ca8cd 100644 --- a/docs/wafd/umn/waf_01_1172.html +++ b/docs/wafd/umn/waf_01_1172.html @@ -41,7 +41,7 @@

Multiplier for Consecutive Breakdowns

-

The maximum multiplier you can use for consecutive breakdowns. The number of breakdowns are counted from 0 every time the accumulated breakdown protection duration reaches 3,600s.

+

The maximum multiplier you can use for consecutive breakdowns. The number of breakdowns is counted from 0 every time the accumulated breakdown protection duration reaches 3,600s.

For example, assume that Initial Downtime (s) is set to 180s and Multiplier for Consecutive Breakdowns is set to 3.