Skip to content

Commit 52c8550

Browse files
APPSEC-58494: Add threat alias to inapp waf page (#30777)
1 parent 4a6287f commit 52c8550

File tree

1 file changed

+7
-6
lines changed

1 file changed

+7
-6
lines changed

content/en/security/application_security/policies/inapp_waf_rules.md

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,16 @@ title: In-App WAF Rules
33
aliases:
44
- /security_platform/application_security/event_rules
55
- /security/application_security/event_rules
6+
- /security/application_security/threats/inapp_waf_rules
67
---
78

89
## Overview
910

1011
With App and API Protection (AAP) enabled, the Datadog tracing library actively monitors all web services and API requests for suspicious security activity.
1112

12-
An _In-App WAF rule_ specifies conditions on the incoming request to define what the library considers suspicious. The Datadog tracing library includes hundreds of out-of-the-box AAP In-App WAF rules, which are used to display security traces in the trace explorer and in the default signal rules.
13+
An _In-App WAF rule_ specifies conditions on the incoming request to define what the library considers suspicious. The Datadog tracing library includes hundreds of out-of-the-box AAP In-App WAF rules, which are used to display security traces in the trace explorer and in the default signal rules.
1314

14-
You can add to the In-App WAF rules without upgrading the tracing library.
15+
You can add to the In-App WAF rules without upgrading the tracing library.
1516

1617
## Structure of an AAP In-App WAF rule
1718

@@ -33,7 +34,7 @@ An input represents which part of the request the operator is applied to. The fo
3334
| `server.request.body` | The parsed HTTP body (key/value map) | `data.items[0] => value0, data.items[1] => value1` |
3435
| `server.response.status` | The http status code | `200` |
3536

36-
#### Operators
37+
#### Operators
3738

3839
| name | Description |
3940
|------|-------------|
@@ -46,7 +47,7 @@ An input represents which part of the request the operator is applied to. The fo
4647

4748
Custom In-App WAF rules enable users to log or block specific types of requests to their applications. For example, you can use custom rules to monitor login success or failure. To get started, navigate to **Security** -> **App and API Protection** -> **Policies** -> **In-App WAF** -> [**Custom Rules**][4].
4849

49-
**Note:** Default rules in In-App WAF are read-only. To refine your In-App WAF behavior, modify the In-App WAF rules. Default rules cannot be modified, however, you can create a custom rule based on one of the default rules, and modify the match conditions to your needs. Be sure to disable the default rule so that you don't have two similar rules evaluating the same requests.
50+
**Note:** Default rules in In-App WAF are read-only. To refine your In-App WAF behavior, modify the In-App WAF rules. Default rules cannot be modified, however, you can create a custom rule based on one of the default rules, and modify the match conditions to your needs. Be sure to disable the default rule so that you don't have two similar rules evaluating the same requests.
5051

5152
## Configure an AAP In-App WAF rule
5253

@@ -97,7 +98,7 @@ Services using a policy are visible directly in the policy management page.
9798

9899
4. Using a utility such as SCP or FTP, copy the `appsec-rules.json` file to your application server, for example, `/home/asm/appsec-rules.json`.
99100

100-
5. Following the instructions in [Enabling AAP][3] for adding application variables in your environment, add the `DD_APPSEC_RULES` environment variable to your service with the full path to the file:
101+
5. Following the instructions in [Enabling AAP][3] for adding application variables in your environment, add the `DD_APPSEC_RULES` environment variable to your service with the full path to the file:
101102
```
102103
DD_APPSEC_RULES=/home/asm/appsec-rules.json
103104
```
@@ -106,7 +107,7 @@ Services using a policy are visible directly in the policy management page.
106107

107108
## What to do next
108109

109-
Next, [configure detection rules to create security signals][1] based on those security traces defined by the In-App WAF rules you created. You can modify the provided out-of-the-box AAP detection rules or create new ones.
110+
Next, [configure detection rules to create security signals][1] based on those security traces defined by the In-App WAF rules you created. You can modify the provided out-of-the-box AAP detection rules or create new ones.
110111

111112
[1]: /security/application_security/policies/custom_rules/
112113
[2]: https://app.datadoghq.com/security/appsec/in-app-waf

0 commit comments

Comments
 (0)