Overview

Scenario

SecMaster provides this built-in playbook to automatically blacklist source IP addresses reported in high-risk alerts in WAF.

How the Playbook Works

The Automatic security blocking of WAF attacks playbook has matched the Automatic security blocking of WAF attacks workflow.

Figure 1 Automatic security blocking of WAF attacks

Prerequisites

• You have enabled WAF access logs or WAF attack logs on the Data Integration page under Settings in the current workspace. For details, see Data Integration.
  Figure 2 Enabling Access to WAF logs
  
• The ThreatBook quota is sufficient.

Verification

If the IP address is blocked, the IP address should be included in the WAF blacklist. The procedure is as follows:

1. Log in to the WAF console, go to the Policies page, and click the name of the target protection policy.
2. On the protection policy details page, click Blacklist and Whitelist in the Protection Details area. You can see that the IP address is listed in the WAF blacklist.

Figure 3 Blacklist and Whitelist