Nemesida WAF and Nemesida AI | Nemesida WAF

Sets the limit of blocked requests. If the allowed number of requests specified by the rate option is exceeded, the IP address will be blocked for the time (in seconds) specified in block_time.

Example:

{... "nwaf_limit": "rate=5r/m block_time=600" ...}

The domain parameter is optional and is only required to set the limit of blocked requests for a specific domain. To do this, need to bring the parameter to the form: nwaf_limit rate=... block_time=... domain=.... Strict matching and wildcard values are allowed: *, example.com, .example.com, *.example.com.

Example:

{... "nwaf_limit": "domain=example.com rate=5r/m block_time=600" ...}

To set different limits for different domains, specify parameters for each of them.

Example:

{... "nwaf_limit": "domain=a.example.com rate=5r/m block_time=300, domain=example.com rate=5r/m block_time=300" ...}

or

{... "nwaf_limit": "rate=10r/m block_time=600, domain=example.com rate=5r/m block_time=300" ...}

In the last example, limits will be set for 5 requests per minute for the domainexample.com (followed by blocking the attacker’s IP address for 300 seconds), as well as limits on 10 requests per minute for all other domains (followed by blocking the attacker’s IP address for 600 seconds).

Deactivation of the request analysis mechanism by Nemesida WAF for a specific IP address or subnet.

Example:

{... "nwaf_ip_wl": "127.0.0.1, 192.168.0.1" ...}

{... "nwaf_ip_wl": "127.0.0.1, 192.168.0.1" ...}

When using "nwaf_ip_wl": "domain=example.com 127.0.0.1" the analysis mechanism will be deactivated only when accessing from a specific IP address to a specific domain. The domain option is optional. It is allowed to use strict compliance and wildcard values: *, example.com , .example.com , *.example.com . An address with a subnet mask or a range of addresses can be used as an IP address.

Example:

{... "nwaf_ip_wl": "127.0.0.1, 192.168.61.0/24, 192.168.61.1-192.168.61.255" ...}

To reduce the number of false positives, it is recommended to specify the static IP address of users (administrators, content managers, editors) in the parameter nwaf_ip_wl. Requests that fall under the action of the parameter will not be blocked, passed to RabbitMQ, and, as a result, analyzed by the Nemesida AI module. Be extremely careful when using the parameter.

IPv6 and IPv4 addresses are allowed.

Configuring request processing for a specific IP address or subnet with fixation in the DBMS, but without actual blocking (IDS mode).

Example:

{... "nwaf_ip_lm": "127.0.0.1, 192.168.0.1" ...}

When using "nwaf_ip_lm": "domain=example.com 127.0.0.1" the pass will be made only when accessing from a specific IP address to a specific domain. The domain option is optional. Strict matching and wild card values are allowed: *, example.com, .example.com, *.example.com. An address with a subnet mask or a range of addresses can be used as an IP address.
Example:

{... "nwaf_ip_wl": "127.0.0.1, 192.168.61.0/24, 192.168.61.1-192.168.61.255" ...}

IPv6 and IPv4 addresses are allowed.

Deactivation of the request analysis mechanism by Nemesida WAF for a virtual host. With the parameter nwaf_host_wl *, skipping will be performed for all virtual hosts.

Example of using a single value:

{... "nwaf_host_wl": "*" ...}

or

{... "nwaf_host_wl": "example.com" ...}

or

{... "nwaf_host_wl": "*.example.com" ...}

Example of using multiple values:

{... "nwaf_host_wl": "example.com, a.example.com" ...}

or

{... "nwaf_host_wl": "example.com, *.example.com" ...}

Configuring request processing for a specific virtual host with a commit in the DBMS, but without actual blocking (IDS mode). With the parameter nwaf_host_lm *, skipping will be performed for all virtual hosts.

Example of using a single value:

{... "nwaf_host_lm": "*" ...}

or

{... "nwaf_host_lm": "example.com" ...}

or

{... "nwaf_host_lm": "*.example.com" ...}

Example of using multiple values:

{... "nwaf_host_lm": "example.com, a.example.com" ...}

or

{... "nwaf_host_lm": "example.com, *.example.com" ...}

The parameter that activates the LM mode (IDS) for requests defined by the Nemesida AI MLA module as illegitimate.

If the name of the virtual host from the request falls under the action of the parameter, then such a request is fixed in the database management system, but is not blocked.

Example of using a single value:

{... "nwaf_mla_host_lm": "*" ...}

or

{... "nwaf_mla_host_lm": "example.com" ...}

or

{... "nwaf_mla_host_lm": "*.example.com" ...}

Example of using multiple values:

{... "nwaf_mla_host_lm": "example.com, a.example.com" ...}

or

{... "nwaf_mla_host_lm": "example.com, *.example.com" ...}

A parameter that activates the WL mode for requests defined by the Nemesida AI MLC module as illegitimate.

If the name of the virtual host from the request falls under the action of the parameter, then such a request is not recorded in the DBMS and is not blocked.

Example of using a single value:

{... "nwaf_ai_extra_host_wl": "*" ...}

or

{... "nwaf_ai_extra_host_wl": "example.com" ...}

or

{... "nwaf_ai_extra_host_wl": "*.example.com" ...}

Example of using multiple values:

{... "nwaf_ai_extra_host_wl": "example.com, a.example.com" ...}

or

{... "nwaf_ai_extra_host_wl": "example.com, *.example.com" ...}

A parameter that activates LM mode (IDS) for requests defined by the Nemesida AI MLC module as illegitimate.

If the name of the virtual host from the request falls under the action of the parameter, then such a request is not recorded in the DBMS and is not blocked.

Example of using a single value:

{... "nwaf_ai_extra_host_lm": "*" ...}

or

{... "nwaf_ai_extra_host_lm": "example.com" ...}

or

{... "nwaf_ai_extra_host_lm": "*.example.com" ...}

Example of using multiple values:

{... "nwaf_ai_extra_host_lm": "example.com, a.example.com" ...}

or

{... "nwaf_ai_extra_host_lm": "example.com, *.example.com" ...}

A parameter that activates the LM mode for requests defined by the Nemesida AI MLC module as brute force attacks (BT 7) and flood (BT 9).

If the name of the virtual host from the request falls under the action of the parameter, then such a request is not recorded in the DBMS and is not blocked.

Example of using a single value:

{... "nwaf_bf_detect_host_lm": "*" ...}

or

{... "nwaf_bf_detect_host_lm": ".example.com" ...}

or

{... "nwaf_bf_detect_host_lm": "*.example.com" ...}

Example of using multiple values:

{... "nwaf_bf_detect_host_lm": "example.com, *.example.org" ...}

A parameter that activates LM mode for requests defined by the Nemesida AI MLC module as DDoS attacks (BT 10).

If the name of the virtual host from the request falls under the action of the parameter, then such a request is not recorded in the DBMS and is not blocked.

Example of using a single value:

{... "nwaf_ddos_detect_host_lm": "*" ...}

or

{... "nwaf_ddos_detect_host_lm": ".example.com" ...}

or

{... "nwaf_ddos_detect_host_lm": "*.example.com" ...}

Example of using multiple values:

{... "nwaf_ddos_detect_host_lm": "example.com, example.org" ...}

A parameter that excludes sending some requests to the RabbitMQ server (the nwaf queue).

If the name of the virtual host from the request falls under the action of the parameter, then such a request is not passed to the nwaf queue, and, accordingly, is not processed by the Nemesida AI MLC module (it is not analyzed for anomalies and brute force attacks, does not participate in the construction of behavioral models).

Example of using a single value:

{... "nwaf_rmq_host_exclude": "*" ...}

or

{... "nwaf_rmq_host_exclude": "example.com" ...}

or

{... "nwaf_rmq_host_exclude": "*.example.com" ...}

Example of using multiple values:

{... "nwaf_rmq_host_exclude": "example.com, a.example.com" ...}

or

{... "nwaf_rmq_host_exclude": "example.com, *.example.com" ...}

The parameter that excludes the analysis of the BODY zone by the signature method, as well as sending its contents in the Nemesida AI MLA and Nemesida AI MLC modules. This option is useful if it is not possible to change the value of the client_body_buffer_size parameter in the /etc/nginx/nginx.conf file.

Example:

{... "nwaf_body_exclude": "*" ...}

or

{... "nwaf_body_exclude": "example.com/uploads.php" ...}

or

{... "nwaf_body_exclude": "example.com/uploads" ...}

When applying the parameter, the exact match of the path (vhost/path).

For example, with the value: example.com/uploads the BODY zone analysis exception will be applied for requests to example.com/uploads, but for example.com/uploads.php and example.com/uploads/index.php the parameter will not be applied. With the value *, the BODY zone analysis exception will be applied to any address.

The parameter that excludes the signature method from analyzing the contents of the BODY zone for INPUT requests, as well as sending the contents of the zone to the Nemesida AI MLA and Nemesida AI MLC modules. This option is useful when interacting with ownCloud web applications or similar ones that allow the client to upload a file to the server over the HTTP protocol.

Example of using a single value:

{... "nwaf_put_body_exclude": "*" ...}

or

{... "nwaf_put_body_exclude": "example.com" ...}

or

{... "nwaf_put_body_exclude": "*.example.com" ...}

Example of using multiple values:

{... "nwaf_put_body_exclude": "example.com, a.example.com" ...}

or

{... "nwaf_put_body_exclude": "example.com, *.example.com" ...}

Activate/deactivate the additional request analysis functionality, which allows detecting missed attacks and temporarily blocking their source by IP address. If the additional analysis functionality is inactive, all unblocked requests will be included in the training sample (with the exception of requests that fall under the WL mode, or illegitimate requests that fall under the LM mode).

Example:

{... "main__ai_extra": "true" ...}

Example:

{... "ddos__enable": "true" ...}

Example:

{... "ddos__wl_ip": "127.0.0.1" ...}

vhost – virtual host for which the DDoS detection will be disabled.
path – resource address occurrence.

Strict matching and wildcard values are allowed: *, example.com, .example.com, *.example.com.

Example:

{... "ddos__wl_url": "example.com, .example.com, *.example.com" ...}

or

{... "ddos__wl_url": "example.com/auth" ...}

Example:

{... "ddos__interval": "10" ...}

Example:

{... "ddos__latest_only": "true" ...}

Example:

{... "ddos__send_possible": "true" ...}

The prefix Possible is added to the name of the attack if its type has not been reliably established.

Example:

{... "brute__enable": "true" ...}

Example:

{... "brute__wl_host": "example.com, .example.org, *.example.us" ...}

Example:

{... "brute__interval": "10" ...}

Example:

{... "brute__mav_val": "15" ...}

Example:

{... "brute__brute_detect": "example.com/auth, .example.com/auth" ...}

or

{... "brute__brute_detect": "*.example.com/auth" ...}

Thus, with the set value example.com/auth, brute force attacks will be monitored as for example.com/auth, and for example.com/auth/reset_password.

The parameter is used to detect brute force attacks, but does not block duplicate requests with the same content in the ARGS or BODY zones.

Thus, in case of repeated sending of identical requests (for example, multiple attempts to recover a password by SMS), requests with similar content and falling under the action of the flood_detect parameter will not be deleted, unlike requests with similar content, but falling under the action of the brute_detect parameter.
Example:

{... "brute__flood_detect": "example.com/auth, .example.com/auth" ...}

or

{... "brute__flood_detect": "*.example.com/auth" ...}

Example:

{... "brute__latest_only": "true" ...}

Example:

{... "brute__send_possible": "true" ...}

The prefix Possible is added to the name of the attack if its type has not been reliably established.

The installation parameter of the license key software Nemesida WAF. The key is also used by the Nemesida AI module, if it is located on the same server. The using one license key on two or more examples of nwaf-dyn is prohibited.

With the nwaf_license_key = none parameter or incorrect product key the Nemesida WAF will continue working in Nemesida WAF Free mode.

The parameter that activates the Nemesida WAF functionality for the listed virtual hosts. With the nwaf_host_enable *; parameter, analysis will be performed for all virtual hosts.

Example for use single value:

nwaf_host_enable *;

nwaf_host_enable example.com;

nwaf_host_enable *.example.com;

Example for use many values:

nwaf_host_enable example.com, 1.example.com;

nwaf_host_enable example.com, *.example.com;

Setting the limit of blocked requests. If the allowed number of requests specified by the rate option is exceeded, the IP address will be blocked for the time (in seconds) specified in block_time.

Example:

nwaf_limit rate=5r/m block_time=600;

To set the limit of blocked requests for a specific domain, you need to make the parameter look like: nwaf_limit rate=... block_time=... domain=...;

Example:

nwaf_limit rate=5r/m block_time=600 domain=example.com;

For the domain parameter it is allowed to use a wildcard value.

Activation/deactivation of the mechanism for unlocking an IP address using captcha.

Example:

nwaf_captcha_unban on;

A parameter that activates the mechanism for unlocking an IP address for virtual hosts using captcha for requests detected by the Nemesida AI MLC module as BT 7, BT 9 or BT 10. It is allowed to use a wildcard value.

Example:

nwaf_ban_captcha_host *;

nwaf_ban_captcha_host example.com;

nwaf_ban_captcha_host *.example.com;

More detailed information about the functionality is available in in the corresponding section.

A parameter that determines the location of the captcha page.

Example:

nwaf_ban_captcha_path /captcha_path;

For specify the URL of an arbitrary page with captcha on the Internet, use the nwaf_ban_captcha_url parameter.

Example:

nwaf_ban_captcha_url http://example.com/captcha_path;

The parameter takes precedence over nwaf_ban_captcha_path when used at the same time.

For the correct work of unlocking mechanism, you must activate the nwaf_captcha_unban parameter for a specific URL. Using one instance of Nemesida WAF to protect both the web application and the captcha page will lead to incorrect operation of the unlocking mechanism.

Setting a secret key for syncing blocked IP addresses, which must be identical on all synced instances of Nemesida WAF.

Example:

nwaf_sync_ban_ip_key 1234567890abcdef;

The parameter defines the URL for getting the list of blocked IP addresses and the period of requests. The polling period must be identical on all synced instances of Nemesida WAF.

Example:

nwaf_sync_ban_ip_host srv1.example.com/ban_ip_sync_path 15;
nwaf_sync_ban_ip_host srv2.example.com/ban_ip_sync_path 15;

For IP addresses with a remaining blocking time of less than 60 seconds, synchronization is not performed.

Example:

nwaf_sys_proxy http://proxy.example.com:3128;

For distributions Ubuntu 16.04 and CentOS 7, it is allowed to use a proxy server only from the HTTP scheme.

Example:

nwaf_api_proxy http://proxy.example.com:3128;

For distributions Ubuntu 16.04 and CentOS 7, it is allowed to use a proxy server only from the HTTP scheme.

Set up interaction with the Nemesida WAF API and other related parameters.

host – is parameter defines the address of the Nemesida WAF API server for sending information about attacks, the results of the Nemesida WAF Scanner and Nemesida AI. With the host=none option, data will not be transmitted to the Nemesida WAF API.

Settings of interaction with the Nemesida AI MLA module, where mla_score is the threshold option, upon reaching which the decision to block the request is transmitted to the Nemesida AI MLA module.

Signatures with threshold value is 12 are blocked without sending in Nemesida AI MLA module.

The parameter which excludes some requests sending to the RabbitMQ server (nwaf queue).

If the vitual host name from the request falls within the scope of the parameter, the request is not sent to nwaf queue and is not processed by Nemesida AI MLC module (is not analyzed on anomalies and brute force attacks, does not take part in behavioral models building).

Example for use single value:

nwaf_rmq_host_exclude *;

nwaf_rmq_host_exclude example.com;

nwaf_rmq_host_exclude *.example.com;

Example for use many values:

nwaf_rmq_host_exclude example.com 1.example.com;

nwaf_rmq_host_exclude example.com *.example.com;

The parameter activates LM (IDS) mode for the requests, which were detected as illegitimate by Nemesida AI MLC module. If the virtual host name from the request falls within the scope of the parameter, the request is fixed in the DBMS, but is not blocked.

Example for use single value:

nwaf_ai_extra_host_lm *;

nwaf_ai_extra_host_lm example.com;

nwaf_ai_extra_host_lm *.example.com;

Example for use many values:

nwaf_ai_extra_host_lm example.com, 1.example.com;

nwaf_ai_extra_host_lm example.com, *.example.com;

The parameter activates LM (IDS) mode for the requests, which were detected as illegitimate by Nemesida AI MLA module.

If the name of the virtual host from the request falls under the parameter, the request is fixed in the database management system, but it is not blocked.

Example for use single value:

nwaf_mla_host_lm *;

nwaf_mla_host_lm example.com;

nwaf_mla_host_lm *.example.com;

Example for use many values:

nwaf_mla_host_lm example.com, 1.example.com;

nwaf_mla_host_lm example.com, *.example.com;

The parameter activates WL mode for the requests, that were detected by Nemesida AI MLC module as illegitimate. If the virtual host name from the request falls within the scope of the parameter, the request is not fixed in the DBMS and is not blocked.

Example for use single value:

nwaf_ai_extra_host_wl *;

nwaf_ai_extra_host_wl example.com;

nwaf_ai_extra_host_wl *.example.com;

Example for use many values:

nwaf_ai_extra_host_wl example.com, 1.example.com;

nwaf_ai_extra_host_wl example.com, *.example.com;

The parameter activates LM mode for the requests, that were detected by Nemesida AI MLC module as brute force attacks (BT 7).

If the virtual host name from the request falls under the parameter, the request is fixed in the DBMS, but it is not blocked.

Example for use single value:

nwaf_bf_detect_host_lm *;

nwaf_bf_detect_host_lm .example.com;

nwaf_bf_detect_host_lm *.example.com;

Example for use many values:

nwaf_bf_detect_host_lm example.com, example.org;

The parameter activates LM mode for the requests, that were detected by Nemesida AI MLC module as DDoS attacks (BT 10).

If the virtual host name from the request falls under the parameter, the request is fixed in the DBMS, but it is not blocked.

Example for use single value:

nwaf_ddos_detect_host_lm *;

nwaf_ddos_detect_host_lm .example.com;

nwaf_ddos_detect_host_lm *.example.com;

Example for use many values:

nwaf_ddos_detect_host_lm example.com, example.org;

The parameter that prevents the signature method from analyzing the content of the BODY zone for PUT requests, as well as sending the zone content to the Nemesida AI MLA and Nemesida AI MLC modules. This option is useful when using web applications such as ownCloud or similar that allow the user to upload files via the HTTP protocol.

Example for use single value:

nwaf_put_body_exclude *;

nwaf_put_body_exclude example.com;

nwaf_put_body_exclude *.example.com;

Example for use many values:

nwaf_put_body_exclude example.com, 1.example.com;

nwaf_put_body_exclude example.com, *.example.com;

The parameter that prevents the signature method from analyzing the content of the BODY zone, as well as sending the zone content to the Nemesida AI MLA and Nemesida AI MLC modules. This option is useful if you can’t change the value of theclient_body_buffer_size parameter in the /etc/nginx/nginx.conf file.

Example:

nwaf_body_exclude *;

nwaf_body_exclude example.com/uploads.php;

nwaf_body_exclude example.com/uploads;

When using the parameter, the exact path match (vhost/path) is taken into account.

For example, if the value is example.com/uploads the BODY zone analysis exception will be applied for requests to example.com/uploads, but for example.com/uploads.php and example.com/uploads/index.php this parameter will not be applied.

Configuring the interaction subsystem with RabbitMQ software.

Activation of the mechanism for sending the body of POST and PUT requests to the ClamAV module.

For analyzing only file content from the request body with Content-Type: multipart/form-data, use the FILE_ONLY option.

The file content of the PUT request body is transferred regardless of the FILE_ONLY value.

Deactivation of the request analysis mechanism by means of the Nemesida WAF software for a specific IP address or subnet.

Example:

nwaf_ip_wl x.x.x.x;

With the parameter nwaf_ip_wl x.x.x.x domain=example.com; the analysis mechanism will be deactivated only when accessing a specific IP address to a specific virtual host.
For the domain option it is allowed to use a wildcard value.
As an IP address it is possible to use address with subnet mask (for example, 192.168.0.0/24) or subnet range (for example, 192.168.0.1-192.168.255.255).

To reduce false positives, it is recommended to specify the static IP address of specialized users (administrators, content managers, editors) in nwaf_ip_wl parameter. Requests are put under the parameter will not be blocked, transfered into RabbitMQ annd analysed by Nemesida AI module. Be careful using this parameter.

It is allowed to use IPv6 and IPv4-addresses.

Configuring the pass of all occurrences of the rules for a specific IP address or subnet with the event recorded in the DBMS (IDS mode).

Example:

nwaf_ip_lm x.x.x.x;

With the nwaf_ip_lm x.x.x.x domain=example.com; pass will be made only when contacting a specific IP address to a specific domain.
For the domain option it is allowed to use a wildcard value.
As an IP address it is allowed to use address with subnet mask (for example, 192.168.0.0/24) or subnet range (for example, 192.168.0.1-192.168.255.255).

It is allowed to use IPv6 and IPv4-addresses.

Deactivation of the request analysis mechanism, using Nemesaida WAF instruments, for the virtual host. Using parameter nwaf_host_wl *; the pass will be made for all virtual hosts.

Example for use single value:

nwaf_host_wl *;

nwaf_host_wl example.com;

nwaf_host_wl *.example.com;

Example for use many values:

nwaf_host_wl example.com, 1.example.com;

nwaf_host_wl example.com, *.example.com;

Configuring the pass of all occurrences of the rules for a specific virtual host with the event captured in the DBMS (IDS mode). With the parameter nwaf_host_lm *; the pass will be made for all virtual hosts.

Example for use single value:

nwaf_host_lm *;

nwaf_host_lm example.com;

nwaf_host_lm *.example.com;

Example for use many values:

nwaf_host_lm example.com, 1.example.com;

nwaf_host_lm example.com, *.example.com;

Configuring the blocking exclusion list for the contents of the request body or downloadable file by the MD5 amount (the MD5 amount is contained in the error.log of the Nginx software).

Example of a log entry:

Nemesida WAF: blocked by ClamAV, stream: Eicar-Test-Signature FOUND, md5: 44d88612fea8a8f36de82e1278a-bb02f, ...

Example of WL rule:

nwaf_clamav_wl 44d88612fea8a8f36de82e1278a-bb02f

Activation of the parameter for recording information about all occurrences of blocking rules (attack signatures) in the Nginx software error log. By default, the parameter is deactivated (commented out). When a parameter is deactivated, only the signature is written to the error log of the Nginx software, which led to blocking the request or fixing the signature without further blocking (in the LM mode).

Using thenwaf_log_mr_all domain=example.com; parameter the record of the recorded occurrances will do only for specific domain. For the domain option it is possible to use wildcard value.

This parameter is used for defining search engine robots. Blocked requests that fall under the parameter do not increase the value of the rate counter and cannot cause the IP address to be blocked. The first parameter value is defined in the User-Agent zone. The second parameter value defines the host name obtained by reverse IP address conversion. If the second value is not set, it is considered equal to the first one.

Example:

nwaf_check_bot_name "example.com" "example.net";

nwaf_check_bot_name "example.com";

nwaf_check_bot_name "bingbot" "msn.com";

nwaf_check_bot_name "yandex.ru";

The parameter defining the location of the file with the GeoIP2 base. Used by the extended locking mechanism.

Example:

nwaf_geoip_db_path /opt/geoip/GeoLite2-Country.mmdb;

For correct operation, it is necessary to grant the Nginx web-server access to read the specified file.

Disputed requests are defined as follows:
– if the signature analysis determined the request as illegitimate, and the Nemesida AI MLA module determined it as legitimate;
– if the signature analysis determined the request as legitimate, and the Nemesida AI MLA module determined it as illegitimate.

Wildcard values can be used. The model in the request is applied in the following order of priority from highest to lowest:

1. vhosts_list = example.com – building and applying a model for the certain domain;
2. .example.com – building and applying a model for the domain .example.com and its subdomains;
3. *.example.com – building and applying the model only for subdomains *.example.com, excepting the main domain example.com;
4. * – building and applying the model for the rest domains.

Example:

vhosts_list = example.com 1.example.com 2.example.com

– building and applying models for the listed virtual hosts.

It is not allowed to use example.com and .example.com together. If you want to use one model for a domain and another for its subdomains, then use example.com and *.example.com.

Example:

vhosts_list = example.com *.example.com

When applying behavioral models to a request, the domain level is taken into account, that is, the model corresponding to the virtual host from the request will be applied, and if it is not present, the model that includes this domain will be applied.

So, for a request with a domain name b.example.com the model will be applied b.example.com, if there is no such model — example.com, if there is no such model, then the model *.example.com.

You can change the model training period by setting a list of domain names: x:example.com, where x is the training period in days. For example, 5:example.com – model training will last 5 days.

Example:

nwaf_license_key = 1234567890

Example:

rmq_host = guest:guest@192.168.0.1 guest:guest@192.168.0.2

Example:

rmq_host_local = guest:guest@127.0.0.1

If this parameter is omitted, the following values will be used: guest:guest@127.0.0.1.

Example:

sys_proxy = http://proxy.example.com:3128

Example:

api_proxy = http://proxy.example.com:3128

If the parameters have no values, the module will try to use the parameters from the nwaf.conf file.

Changes to files are applied automatically without restarting Nemesida AI MLC.

vhost – the name of the virtual host for which the DDoS detection functionality will be disabled.
path – resource address entry.

For virtual host are allowed wildcard values.

Example:

example.com
.example.com
*.example.com
example.com/auth

Changes to files are applied automatically without restarting Nemesida AI MLC.

Examples:
wl_host = example.com .example.org *.example.us

Parameter changes are applied automatically, without restarting Nemesida AI MLC.

example.com/auth
.example.com/auth
*.example.com/auth

Thus, when the value is set example.com/auth brute force attacks will be monitored for both example.com/auth, and for example.com/auth/reset_password.

This parameter is used to detect brute force attacks, but it does not block repeated requests (when the content in the ARGS or BODY zones is passed several times).

For addresses not specified in the file, brute force attacks are not detected. Changes to files are applied automatically without restarting Nemesida AI MLC.

Thus, in the case of repeated sending of identical requests (for example, multiple attempts to recover the password via SMS), requests that have similar content and fall under the action of the flood_detect parameter will not be deleted, unlike requests that have similar content but fall under the action of the brute_detect parameter.

For addresses not specified in the file, flood attempts are not detected. Changes to files are applied automatically without restarting Nemesida AI MLC.

Disputed requests are defined as follows:
– if the signature analysis determined the request as illegitimate, and the Nemesida AI MLC module was defined as legitimate;
– if the signature analysis determined the request as legitimate, and the Nemesida AI MLC module was defined as illegitimate.

Requests that fall within the scope of the rules with an indicator value of 12 are blocked without being sent to other analysis subsystems. More information is available in the corresponding section.

Zone application of the rule. To apply a signature to all zones, use the empty "Z:" parameter. Required.

To apply a signature to multiple zones, use the delimiter "Z:URL|BODY".

To force the request to the Nemesida AI MLA module use MLA value in rules application zone ("Z:MLA") while digital significance indicator (SC) must be less than 12.

To disable sending a request to the Nemesida AI MLA module, use the NoMLA value in the rule application area ("Z: NoMLA").

To disable IP address blocking due to the occurrence of a signature that has score = 12, use the value NoBan in the rule area ("Z:NoBan"). Entering a signature with such a zone does not reduce the nwaf_limit counter, meaning it does not block the IP address.

To clarify the zone, you can use additional options. For "Z:ARGS|$URL:/templates" the rule will work only in the ARGS zone with /templates parameter in URL.

For signatures in zone area, you can use the NoAPI value to disable sending a message to the Nemesida WAF API that falls under the action of the created signature. For all triggers of this signature, the message will not be sent to the Nemesida WAF API, but it will be blocked and written to the log file. This value is only used for signatures that have score = 12. For signatures with a different score, this value is ignored.

RL ID:50001 "P:select from" "SC:SQL:12" "Z:ARGS|URL|BODY|NoAPI";

For zone area you can use the LM value, which activates the LM mode for a request that falls under the action of the created signature. Each request that falls under the signature will not be blocked, but a corresponding message will be sent to the Nemesida WAF API about it, which is also recorded in the log file. The LM value is only used for signatures that have score = 12. For signatures with a different score, this value is ignored.

RL ID:50002 "P:select from" "SC:SQL:12" "Z:ARGS|URL|BODY|LM";