Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 8 replies
  • Subscribers 1 subscriber
  • Views 6719 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WAF in monitoring mode

MDR
While my WAF is in monitoring mode , can I find out what attacks would be blocked if I switch over into rejecting mode ,


This thread was automatically locked due to age.
  • 0
    Yes, watch the Web Application Firewall log.

    ----------
    Sophos user, admin and reseller.
    Private Setup:

    • XG: HPE DL20 Gen9 (Core i3-7300, 8GB RAM, 120GB SSD) | XG 18.0 (Home License) with: Web Protection, Site-to-Site-VPN (IPSec, RED-Tunnel), Remote Access (SSL, HTML5)
    • UTM: 2 vCPUs, 2GB RAM, 50GB vHDD, 2 vNICs on vServer (KVM) | UTM 9.7 (Home License) with: Email Protection, Webserver Protection, RED-Tunnel (server)
  • 0 in reply to scorpionking
    Sure ? What will indicate that it would blocked ?
  • 0
    Logging & Reporting -> Webserver Protection -> Details -> Top Rules by Virtual Host ?

  • 0
    This is the report - you need to look in the logfile, in the best case while defined requests are made.
  • 0
    Yes I know I have to look into the logfiles , but what will indicate that a "reject" will happen.
    I can't rely on message "http error 403" because in monitor mode it is tranformed into a" http 200" . I can't rely on message "security3.error messages" or "severity: CRITICAL" because these messages are not always blocking.
  • 0
    I use Search log files - WAF log - Search term: modsecurity
    Then I see lines like:

    [client 198.20.69.74] ModSecurity: Warning. Pattern match "^5\\d{2}$" at RESPONSE_STATUS. [file "/usr/apache/conf/waf/modsecurity_crs_outbound.conf"] [line "53"] [id "970901"] [rev "2"] [msg "The application is not available"] [data "Matched Data: 500 found within RESPONSE_STATUS: 500"] [severity "ERROR"] [ver "OWASP_CRS/2.2.7"] [maturity "9"] [accuracy "9"] [tag "WASCTC/WASC-13"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.6"] [hostname "my.url"] [uri "/"] [unique_id "VO5xAsOShSEAABz8O6sAAABD"]


    [id "970901"] is rule number I need to know
  • 0
    The ID number is what you could use in a Firewall Profile to skip specific rules.
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0
    As mentionned before, I have my WAF temporarily configured in monitor mode !
    Now I wish to know what kind of traffic will be blocked , when I would switch over in rejected mode !
    It is not because there is a ruleID that traffic will be blocked.
    http error 403 is converted into http error 200 in monitor mode.
    How to find out what kind of traffic will be blocked ?
Unfiltered HTML