open-appsec
WebsiteManagement PortalPlaygroundGitHub
  • open-appsec Documentation
  • What is open-appsec?
  • open-appsec Video Tutorials
  • Release Notes
  • Getting started
    • Getting Started
    • Start With Kubernetes
      • Install Using Interactive CLI Tool (Ingress NGINX)
      • Configuration Using Interactive CLI Tool
      • Install Using Helm
      • Install Using Helm - new flow (beta)
      • Configuration Using CRDs
      • Configuration Using CRDs - v1beta2
      • Configuration using CRDs - special options for Large Scale Deployments
        • Using appsec class for assigning separate custom resources to specific deployments
        • Using namespace-scoped custom resources
      • Monitor Events
    • Start With Linux
      • Install open-appsec for Linux
      • Using the open-appsec-ctl Tool
      • Configuration Using Local Policy File (Linux)
      • Local Policy File (Advanced)
      • Local Policy File v1beta2 (beta)
      • Monitor Events
    • Start with Docker
      • Install With Docker (Centrally Managed)
      • Install With Docker (Locally Managed)
      • Deploy With Docker-Compose (Beta)
      • Configuration Using Local Policy File (Docker)
      • Local Policy File (Advanced)
    • Using the Web UI (SaaS)
      • Sign-Up and Login to Portal
      • Agents Deployment
      • Connect Deployed Agents to SaaS Management Using Tool (K8s & Linux)
      • Connect Deployed Agents to SaaS Management Using Helm (K8s)
      • Connect Deployed Agents to SaaS Management (Docker)
      • Create a Profile
      • Protect Additional Assets
      • Monitor Events
    • Using the Advanced Machine Learning Model
  • Concepts
    • Agents
    • Management & Automation
    • Security Practices
    • Contextual Machine Learning
  • SETUP INSTRUCTIONS
    • Setup Web Application Settings
    • Setup Custom Rules and Exceptions
    • Setup Web User Response Pages
    • Setup Log Triggers
    • Setup Behavior Upon Failure
    • Setup Agent Upgrade Schedule
  • Additional Security Engines
    • Anti-Bot
    • API Schema Enforcement
    • Data Loss Prevention (DLP) Rules
    • File Security
    • Intrusion Prevention System (IPS)
    • Rate Limit
  • Snort Rules
    • Import Snort Rules
    • Write Snort Signatures
  • HOW TO
    • Configuration and Learning
      • Track Learning and Move From Learn/Detect to Prevent
      • Configure Contextual Machine Learning for Best Accuracy
      • Track Learning and Local Tuning in Standalone Deployments
      • Move From Detect to Prevent in K8s With Many Ingress Rules
  • Deployment and Upgrade
    • Load the Attachment in Proxy Configuration
    • Upgrade Your Reverse Proxy/API Gateway When an Agent is Installed
    • Integration in GitOps CD (K8s)
    • Build open-appsec Based on Source Code
  • Management Web UI
    • Track Agent Status
    • Delete or Reset Management Tenant (SaaS)
    • Disconnect an open-appsec agent from Central Management
  • Integrations
    • About Integrations With 3rd Party Solutions
    • CrowdSec
      • CrowdSec Bouncer Support
      • CrowdSec Intelligence Sharing Using open-appsec Parser/Scenario
    • NGINX Proxy Manager
      • Install NGINX Proxy Manager with open-appsec managed from NPM WebUI
      • Install NGINX Proxy Manager with open-appsec managed from central WebUI (SaaS)
      • Frequently Asked Questions
      • How to Migrate from an Existing NGINX Proxy Manager Deployment and Keep Configuration
    • NPMplus
    • Docker SWAG
      • Install Docker SWAG with open-appsec (locally managed)
      • How to connect locally managed Docker SWAG with open-appsec to WebUI
      • Install Docker SWAG with open-appsec (centrally managed)
      • Deploy Docker SWAG with docker-compose (beta)
      • Frequently Asked Questions
  • Troubleshooting
    • Troubleshooting
    • Troubleshooting Guides
      • Configuration contains ingress/asset with URL which already has asset attached to it in your tenant
      • HTTP Request to Port 80 Not Returning as Expected
      • Agent Fails to Recognize HTTP Transactions with NGINX
      • Agent Not Recognizing Initial HTTP Requests
      • Handling Large Requests (413 Responses)
      • open-appsec on Docker HTTP Transaction Handler Is Set To Ready
      • Traffic Recognition Issue on Single-Core Machine/Connection Timed Out
      • Installing open-appsec on CentOS 7
      • SELinux: checking status and disabling
      • Deploy open-appsec directly on the web server hosting the application to protect
      • object is locked or remote, and therefore cannot be modified
      • Failed to Register to Fog
  • references
    • Agent CLI
    • Event Query Language
    • Events/Logs Schema
    • WAF Comparison Project
Powered by GitBook
On this page
  • Web Application Protection Advanced Settings
  • Web Attacks Settings
  • Configuration Options
  • Additional Security Engines

Was this helpful?

  1. SETUP INSTRUCTIONS

Setup Web Application Settings

PreviousContextual Machine LearningNextSetup Custom Rules and Exceptions

Last updated 3 months ago

Was this helpful?

Configuring is easily done by configuring the relevant asset using its basic details, and in the vast majority of the cases, is enough to protect the web assets without additional manual changes.

There are, however, advanced options that a security administrator can configure to modify the security to his specific requirements.

Web Application Protection Advanced Settings

Web Attacks Settings

Browse to Assets, edit the web application asset object you have created and click on the "Web Attacks" Tab and look at the "Web Attacks" sub-practice configuration.

Configuration Options

Mode override

Setting the Mode to As Top Level means inheriting the primary mode of the practice.

Otherwise you can override it only for this specific sub-practice to Detect/Prevent/Disable.

Confidence-dependent Prevent Mode

The option Activate when confidence is becomes available if practice or sub-practice are set to Prevent. The value determines the threshold in which open-appsec will block attacks and prevent them, rather than just send a log according to Log Trigger configuration.

Advanced settings window

When clicking on Advanced additional advanced settings appear:

For all Size Limits - open-appsec Web Attacks engine will accept traffic that exceeds the limits if set to Detect/Learn mode (and that traffic will bypass inspection), or block traffic that exceeds the limits if set to Prevent mode.

Advanced Setting
Meaning

URL Size (Bytes)

Determines the URL size limit for inspection

Max Object Depth

Determines the depth limit of a JSON/XML object inspected in the HTTP request. This includes embedded XML in JSON and the opposite.

Body Size (Kilobytes)

Determines the HTTP body size limit for inspection

Header Size (Bytes)

Determines the HTTP header size limit for inspection

CSRF Protection

Error Disclosure

Open Redirect

Non-Valid HTTP methods

When set to No and practice is set to Prevent, non-valid HTTP methods are blocked. Valid HTTP methods are:

  • GET, POST, DELETE, PATCH, PUT, CONNECT, OPTIONS, HEAD, TRACE

  • MKCOL, COPY, MOVE, PROPFIND, PROPPATCH, LOCK, UNLOCK, VERSION-CONTROL, REPORT, INDEX, CHECKOUT, CHECKIN, UNCHECK, MKWORKSPACE, UPDATE, LABEL, MERGE, BASELINE-CONTROL, MKACTIVITY, ORDERPATCH, ACL, SEARCH, MKREDIRECTREF, BIND, UNBIND

Additional Security Engines

open-appsec includes additional security engines other in addition to the Machine Learning based-Web Attacks protection and API attacks protection:

Determines the mode for the advanced CSRF protection, which blocks . Important - This protection has a performance impact.

Determines the mode for the advanced Error Disclosure protection, which replaces and injects a different response instead. Important - This protection has a performance impact.

Determines the mode for the advanced Open Redirect protection, which prevents (e.g. as used by Phishing attacks) Important - This protection has a performance impact.

Anti-Bot
API Schema Enforcement
Intrusion Prevention System (IPS)
Import Snort Rules
Rate Limit
CSRF attacks
internal error codes in the response
client side redirection to other domains
Web Application security