Edit Web Application/API Settings
There are, however, advanced options that a security administrator can configure to modify the security to his specific requirements.
When making the first change to the default Web Application Best Practice's configuration such as configuring the advanced settings in this page, you will be prompted to change the name of the Practice to your own custom practice name.
Browse to Assets, edit the web application asset object you have created and click on the "Threat Prevention" Tab and look at the "Web Attacks" sub-practice configuration.
Setting the Mode to As Top Level means inheriting the primary mode of the practice.
Otherwise you can override it only for this specific sub-practice to Detect/Prevent/Disable.
The option Activate when confidence is becomes available if practice or sub-practice are set to Prevent. The value determines the threshold in which open-appsec will block attacks and prevent them, rather than just send a log according to Log Trigger configuration.
When clicking on Advanced additional advanced settings appear:
For all Size Limits - open-appsec Web Attacks engine will accept traffic that exceeds the limits if set to Detect/Learn mode (and that traffic will bypass inspection), or block traffic that exceeds the limits if set to Prevent mode.
The advanced configuration for API Attacks is very similar to Web Attacks. The differences being:
- The sub-practice is named API Attacks and not Web Attacks.
- API attacks do not include the advanced options of CSRF Protection, Error Disclosure and Open Redirect.
open-appsec includes additional security engines other in addition to the Machine Learning based-Web Attacks protection and API attacks protection: