Web Application Firewall (WAF) Signatures

Overview

This guide explains the security threat intelligence feature of Avi Pulse.

Deploying WAF Signatures

WAF signature is one of the security services delivered through Pulse. WAF signature service is based on Opt-In basis, which is disabled by default.

  • The Avi WAF protects web applications from common vulnerabilities as identified by Open Web Application Security Project (OWASP), such as SQL Injection (SQLi) and Cross-site Scripting (XSS), while providing the ability to customize the rule set for each application.

  • Avi Vantage publishes WAF signature (Core Rule Set) every quarter using a controlled release management process. The artifacts are pushed to AWS S3 Buckets.

  • Once the WAF signature is published, it is available on Avi Pulse portal.

  • The API is provided with the link to download WAF signature. The link has pre-signed URL with validity of 1 hour

You can deploy latest WAF signature data on to the Controller available for applications to utilize it.

The following are the two ways to deploy WAF signature data on the Controller:

  • Automated

  • Manual

Automated

You can check Auto Download WAF Signatures option in Opt-In settings window to deploy automatically.

Automated deployment of WAF signatures gets enabled only when it is explicitly opted in from Pulse Opt-in page.

  • Automated workflow gets enabled once WAF signature service is opted in. This can be done at any time.

  • You can provide the consent to acknowledge the auto deployment of latest WAF signature data on to the Controller.

  • Whenever the new version of WAF signature data is available and is not deployed on the specific Controller, then that data is deployed, and the Controller UI is informed about the status of deployment.

Manual

You can check WAF Signatures Notifications option in Opt-In settings window to deploy manually.

  • If you have not opted-in for auto deployment of WAF signature data on to the Controller, the Controller will not deploy the latest data automatically on it, instead an event with download link to download the data file will be generated.

  • You can click on this link to download the WAF signature data file on to the local system.

  • You need to upload the same file from the Controller manually by navigating to Templates > WAF > CRS. Click on Upload File button to upload WAF signature files.

Viewing Events for Debugging WAF Signature

You can view events for debugging WAF signature issues as follows:

event_for_update_notifictaion_of_waf