WAF/WAAP
This section describes the knowledge base of how to use Haltdos WAF / WAAP to adequately protect Web & API applications.
Some of the WAF use cases are mentioned below:
- Configuring HTTP Redirection
- Configure Machine Learning for 0-day protection
- How to add custom headers for origin servers ?
- Sending custom header or cookies to the client
- Configuring multiple security profiles for complex applications
- Adding Health monitoring on backend servers
- Selecting appropriate Server Group based on the incoming request
- Configuring secure File upload
- Configuring passwords by enabling organization-specific password policy.
- Configuring AV Scanner for an application behind WAF
- Masking login credentials like passwords
- Preemptive bot protection by WAF
- Securing websites from brute force attack
- How to enable IPv6 support in the listener.
- How to configure custom HTML error page received from Haltdos Web Application Firewall.
- How do I configure a Syslog server on Haltdos WAF?
- How to check Incident details in Haltdos WAF plateform?
- How to change Web Application Firewall mode in between Record, Bypass & Mitigation?
- How can user restrict the file upload of any particular file extension?
- How to add custom listener ports post creating the listner?
- How to allow access to only few IPs for backend web application?
- How to change temperory blacklist duration?
- How to change load balancing algorithem for any server group?
- How to add a new server?
- How to create/add a new server group in a listener?
- How to mark any server as down true (soft down)?
- How to mark any server as backup server?
- How to upload SSL certificate and use them for a web application (listener)?
- How to add a custom security profile?
- How to mitigate bad reputation traffic with Haltdos WAF?
- How to whitelist any IP or IP segment for a listener?
- Modifying default signature status.
- How to configure JSON policies?
- How to configure the allowed HTTP methods?
- How to configure bot protection settings in order to ensure protection from reconnaissance and scraping activities?
- How to configure Blacklist and Whitelist IP addresses?
- How to allow/block and add suspicious crawlers?
- How to rate limit the end user requests?
- How to configure web extensions and restricted extensions and validation?
- Mitigating XSS attack
- Mitigating SQL injection attack
- How do user set maximum HTTP body and header size ?
- How to set/change the keep-alive timeout for server and client?
- Condition based redirection.
- How to set maximum allowed Bot request rate from a single client IP?
- How to set mitigation for Path/Directory traversal attack?
- How to set mitigation for OS command Injection?
- How to add client certificates?
- How to add a listener?
- How a user extract or set a custom variable by using Variable Rules in Haltdos WAF?
- How to make form rule to offers a positive security model for Application Firewall ?
- How to make Firewall rules that allow client to create custom security rules as per application logic?
- How the rate limit rule restrict over-usage of client application by throttling requests on matching users?
- How Whitelist rule allows to add exceptions on existing rules (custom and managed)?
- How to create a response rule to filter responses from applications and prevent sensitive data leaks?
- How to configure NTP through Haltdos Solution?
- How to mask sensitive data content like CCN/SSN?
- How to prevent sites from XML Bomb attack?
- How to prevent Cross-site Request Forgery through Haltdos WAF?
- How to configure TLS and SSL versions from Haltdos console?
- How to prevent sites from JSON injection?
- How to achieve better performance through Haltdos WAF?
- How WAF mitigate RCE attacks?
- How to whitelist request based on particular pattern?
- How to set rule staging from Haltdos console for managing Signatures?
- How to check the backend server down incident on Haltdos console?
- How to configure IP transparency through Haltdos Solution?
- Why do we need to configure web application to accept traffic from WAF only?
- How to capture packet and trace them through tcp dump utility?
- How to decrypt SSL/TLS traffic using Wireshark and private keys?
- How to decrypt SSL/TLS using Wireshark and SSLKEYLOGFILE environment variable on Firefox or Google Chrome using Wireshark?
- What are the baseline security approaches for an application onboarded on Haltdos WAF
- Primary troubleshooting steps for issues found in applications onboarded on Haltdos WAF
- Adding Admin/Member and configuring password