Managing Built-in Rule Sets

Prerequisites

You have connected the website you want to protect to WAF.

Viewing Default Rules

You can view all built-in rules on the Default Rules tab on the Built-in Rule Sets page.

1. Log in to the WAF console.
2. Click in the upper left corner and select a region or project.
3. (Optional) If you have enabled the enterprise project function, in the upper part of the navigation pane on the left, select your enterprise project from the Filter by enterprise project drop-down list. Then, WAF will display the related security data in the enterprise project on the page.
4. In the navigation pane on the left, choose Objects > Built-in Rule Sets.
5. On the Default Rules tab, view details about all built-in rules and rule updates.
   • Built-in rule details
     By default, all built-in rules are sorted by update time in descending order. In the rule list area, you can:

     • Customize columns to be displayed (① in Figure 1): Click , select the columns you want to display in the rule list, and set whether to automatically wrap the table content.
     • Set filter criteria for the rule list (② in Figure 1): If multiple filter criteria are selected, the filter criteria are displayed in AND logic.
       • Filter rules by update time: You can view rules updated all time or in a custom time range.
       • Filter rules by protection level: You can select All, Loose, Medium, or Tight filter to view corresponding rule sets.
       • Filter rules by attribute: You can select the Rule ID, Rule Description, CVE ID, Risk Severity, Application Type, or Protection Type filter to view a specific rule.
     • Customize rule rankings: Click next to Rule ID, Rule Description, CVE ID, Risk Severity, Application Type, Protection Type, or Updated to rank the rules in ascending or descending order.
     • Copy specified content: Click next to the rule ID, rule description, CVE ID, application type, and protection type to copy the current content.
     Figure 1 Built-in Rules
     

     Table 1 Default rule parameters

     Parameter	Description
     Rule ID	The ID of the protection rule. You can copy the ID and view the protection rule details. For details, see Events.
     Rule Description	A brief description of the rule.
     CVE ID	CVE ID of the vulnerability related to the rule. Common Vulnerabilities and Exposures (CVE) IDs identify known cybersecurity vulnerabilities. One CVE ID corresponds to one vulnerability. The CVE ID is in the format of CVE-Year-Serial number.
     Risk Severity	Severity of the threat the protection rule protects against.
     Application Type	The type of the application where attacks were reported based on the rule.
     Protection Type	Types of attacks the protection rule defends against, including SQL injection, malicious crawlers, local file inclusion, cross-site scripting, command injection, remote file inclusion, and website Trojans.
     Updated	The time the protection rule was updated. A protection rule will be updated based on the attack feature changes to ensure the rule works as expected.

   • Rule updates

     On the Rule Updates panel, view the vulnerability and rule update details.

   • Exporting all built-in rule sets

     Click Export above the rule list to export all built-in rules to an XLSX file.

Creating a Custom Rule Set

To create a custom rule set, submit a service ticket first. To create a custom rule set, you can only copy rules from the built-in loose, medium, or tight rule set, and then update rules and the protective action.

1. Log in to the WAF console.
2. Click in the upper left corner and select a region or project.
3. (Optional) If you have enabled the enterprise project function, in the upper part of the navigation pane on the left, select your enterprise project from the Filter by enterprise project drop-down list. Then, WAF will display the related security data in the enterprise project on the page.
4. In the navigation pane on the left, choose Objects > Built-in Rule Sets.
5. On the Built-in Rule Sets page, click Customize Rule Set.
6. In the Customize Rule Set dialog box, complete the following configurations and click OK.

   Table 2 Parameters for creating a custom rule set

   Parameter	Description	Example Value
   Rule Set Name	The name of the rule set. Enter a maximum of 64 characters. Only digits, letters, hyphens (-), underscores (_), and periods (.) are allowed.	waf
   Remarks	Remarks of the custom rule set.	-
   Original Default Rule Set	The rule set you use to create the custom rule set. You can select Loose rule set, Medium rule set, or Tight rule set.	Loose rule set
   Rule Update	Rule Update: WAF periodically updates built-in rules and synchronizes the updates to the rule set you copied. You can enable or disable automatic update.	Disable
   	Protective action: You can select Block or Log only. The configured protective action will simultaneously apply to basic web protection rules.	Log only

   After completing the preceding configurations, you can select the created custom rule set when configuring basic web protection rules.