Who rated this post

Although configuring Web Application security or Web API security is easily done via the configuration wizard, in most cases, assets are fully protected without additional manual changes, thanks to the CloudGuard AppSec learning mechanism.

Why do I need exceptions?

The most common use case of custom rules and exception configuration is when a log is issued and a security administrator decided that traffic matching one of the log fields (for example, the URI field) should not be detected or blocked by the AppSec engine. This is also known as a “false positive”.

Usually, for new traffic that is being blocked because he was not learned yet or because it looks like an actual attack.

How do exceptions work?

A custom rule/exception is a combination of the specific AppSec security practice that caught the original event and the Asset relevant for the same traffic. Once an exception is put in place, the AppSec engine will work according to the configuration:

• Accept - Traffic matching the exception's conditions will be accepted.
• Drop - Traffic matching the exception's conditions will be blocked.
• Skip - Relevant only for specific keys like "Parameter Name", "Parameter Value", and “Indicator”. Allows skipping the value of the matching parameter from being inspected by the AppSec engines. The rest of the traffic will be inspected for malicious behavior.
• Suppress Log - Traffic matching the exception's condition will not activate their Log Trigger object/s upon an event.

How to create an exception?

1. Identify the Prevent/Detect log you want to create an exception for.
2. For Accept and Skip - make sure that this traffic is indeed legitimate:
   1. Verify that the source is familiar.
   2. Verify that the request is legitimate.
   3. Review the Threat Prevention details and compare the details with the system admin to make sure this transaction is OK.
3. For Drop and Suppress Log - make sure that this traffic is indeed malicious.
4. Right-click on the log and choose “Add Exception”.
5. Choose the Action you want to add: Accept / Drop / Skip / Suppress Log.
6. Review the automated built-in configuration and adjust the values.
   • It’s important to understand the log you are working on in order to create an exception as specific as possible, to act only on the specific parameters shown on the transaction.
   • It is possible to create multiple rules containing AND or OR.
   • In case the specific parameter is in a unique place in the transaction, you can specify where using “Parameter Location” and then “Parameter Name” and “Parameter Value”.
7. Mandatory: Add a comment for this exception.
8. Click OK.

List of Keys Possible to Use:

Examples: