Violation Categories

Additional security checks

How violations are categorized

Entities

• Entities have at least one configurable attribute (such as byte length).
• Entities can have multiple occurrences.
• New instances may be learnable (suitable for addition to the security policy).

Items

• Items can be:
  • Present and enabled
  • Present and disabled
  • Not present

Rating Definitions

Violation Rating: Calculation criteria

The violation rating calculation criteria for the BIG-IP WAF involves assessing various factors to determine the severity of potential threats.

1. Signature Accuracy & Signature Severity:

   • Example: If a request matches a known SQL injection attack signature, the severity rating increases based on the severity level assigned to that signature.

2. User IP Address Location (WAN/LAN):

   • Example: Requests originating from a known malicious IP address (WAN) receive a higher violation rating compared to requests from a trusted internal network (LAN).

3. Meta Character Violation:

   • Example: If a request contains unusual characters commonly used in injection attacks, such as semicolons or quotation marks, it raises suspicion and increases the violation rating.

4. Signature Violation — Numerous Hits:

   • Example: Multiple requests matching the same attack signature within a short timeframe indicate a concerted attack, resulting in a higher violation rating.

5. Signature Violation — Multiple Categories:

   • Example: If a request triggers multiple different types of attack signatures (e.g., SQL injection and cross-site scripting), it indicates a sophisticated attack, warranting a higher violation rating.

6. Server Response — Lower Rating when Error 500 Occurs without Other Violations:

   • Example: If a server responds with an error 500 status code without any other indications of an attack, the violation rating may be lower as it could be due to server misconfiguration rather than an actual attack.

7. Cookie Tampering — Higher Rating:

   • Example: Modifying session cookies in a request to gain unauthorized access to a user’s account would result in a higher violation rating.

8. Evasion Techniques Found Alongside Attack Signatures — Higher Rating:

   • Example: If an attacker attempts to obfuscate their attack payload to evade detection while triggering known attack signatures, it indicates a deliberate effort to bypass security measures, leading to a higher violation rating.

9. IP Reputation — Higher Rating when Client on Suspicious IP:

   • Example: Requests originating from IP addresses with a history of malicious activity or flagged by threat intelligence services receive a higher violation rating due to the increased likelihood of an attack.

Request status

Staging and Enforcing

Learn, Alarm and Block

Enforcement readiness

Enforcement Readiness Example:

On the 5th day, an attack signature is triggered, indicating potential threats. The WAF suggests enforcement based on the severity of the signature. The admin reviews the suggestions and decides to enforce critical signatures.

On the 8th day, the admin manually enforces any remaining untriggered signatures to ensure comprehensive protection.

Managing Triggered Signatures:

Triggered signatures are enforced either manually or automatically based on severity. Untriggered signatures remain in learning suggestions until enforced.

Avoiding False Positives:

• Regularly review and update WAF policies and signatures to align with evolving threats.
• Utilize whitelists for known benign entities to reduce false positives.
• Continuously monitor and adjust WAF configurations based on traffic patterns and attack trends.

Learning Suggestions