Web Application Firewall operator guide

Operating the self-hosted console’s rule management: rules from OWASP CRS v4.0.0, and the SecLang rule import that reports the constructs it does not support.

This guide describes the operator workflow across the WAF console’s operations and tuning pages. All pages are under /dashboard/ in the management UI.

Prerequisites

A tenant and environment must be selected in the top-bar picker before any page loads operational data.

Pages & Workflows

1. Managed Rules — /dashboard/managed-rules

Manage rule packages, view CRS coverage, configure anomaly thresholds, and manage false-positive exclusions.

Workflow:

  1. Packages tab — Browse installed rule packages (OWASP CRS, etc.).
  2. Coverage tab — View per-package rule seeding rate and compatibility status.
  3. CRS Config tab — Toggle CRS on/off, set mode (detect/block), paranoia level, and inbound/outbound anomaly thresholds.
  4. Exclusions tab — Add/remove false-positive exclusions by rule ID, tag, target variable, or route scope.

2. DDoS Operations — /dashboard/ddos

View active DDoS mitigations, anomaly campaigns, and configure rate-limit thresholds.

Workflow:

  1. Active Mitigations tab — Review auto-triggered mitigations. Approve pending ones or clear completed ones.
  2. Recent DDoS Events tab — View anomaly campaigns detected by the DDoS guard.
  3. Threshold / Limit Config tab — Configure global and per-route rate limits, burst allowances, body size limits, and slow-loris timeouts.

3. Reputation Management — /dashboard/reputation

Manage IP/network block/allow lists, country and ASN blocks, and external threat feeds.

Workflow:

  1. Reputation Entries tab — Add, edit, or delete individual reputation entries (IP, CIDR, ASN, country). Import bulk entries from text.
  2. Country / ASN Blocks tab — Block entire countries or AS numbers. Changes are saved via the reputation config endpoint.
  3. Threat Feeds tab — Configure external threat feed sources (AbuseIPDB, Spamhaus, Tor exit nodes) and their polling schedule.

4. ML Tuning — /dashboard/ml

Configure ML scoring thresholds, manage the model registry, and explore scored events.

Workflow:

  1. Scoring Config tab — Set block/monitor/review thresholds and adjust per-signal weights (CRS, reputation, DDoS, bot, API violations, anomaly).
  2. Model Registry tab — View versioned scorer artifacts. Activate a new version or roll back to a previous one.
  3. Scored Events tab — Browse scored events with confidence levels and recommended actions. Click to view top contributing factors.

5. Challenge Analytics — /dashboard/challenge

View challenge outcome metrics, JA3 fingerprint summaries, and CAPTCHA verification rates.

Workflow: Monitor served/solved/failed challenge rates and CAPTCHA success rates. Review JA3 fingerprint distributions to identify suspicious client signatures.

6. Export Destinations — /dashboard/exports

Manage SIEM export destinations for event forwarding.

Workflow:

  1. Add destinations (Splunk, Elastic, Webhook, Syslog) with mapping profiles (JSON, CEF, LEEF, Splunk HEC).
  2. Use Dry Run to test a destination without committing events.
  3. Use Flush to force-send pending events, or Replay to resend.
  4. Health check verifies connectivity to the destination endpoint.

7. Setup Wizard — /dashboard/setup

Guided first-run onboarding.

Workflow:

  1. Create or select a tenant.
  2. Create a default WAF policy with challenge rules.
  3. Review challenge configuration (pre-configured in policy bundle).
  4. Add a SIEM export destination for event forwarding.

Common interface patterns

  • Error messages appear with a retry action when the operation can be repeated.
  • Loading indicators remain visible while operational data is requested.
  • Empty states explain whether you need to select a tenant, create configuration, or change the current filter.
  • Help icons beside fields explain configuration choices in context.