Skip to content

Commit f714583

Browse files
sylwangmjangtravisamartin
authored
N1 waf signature sets release (#1251)
* n1c: add docs for adding signature sets and exceptions * add instructions for urls/cookies/parameters * add titles for all instruction files * Update content/nginx-one/nap-integration/add-signature-sets.md Co-authored-by: Mike Jang <[email protected]> * Update content/nginx-one/nap-integration/add-signature-sets.md Co-authored-by: Mike Jang <[email protected]> * Update content/nginx-one/nap-integration/add-signature-sets.md Co-authored-by: Mike Jang <[email protected]> * Update content/nginx-one/nap-integration/add-signature-sets.md Co-authored-by: Mike Jang <[email protected]> * Update content/nginx-one/nap-integration/add-signature-sets.md Co-authored-by: Mike Jang <[email protected]> * address feedback * reassign weights for pages * update links to doc ref * remove unnecessary top-level titles * Update content/nginx-one/nap-integration/add-cookies.md Co-authored-by: Travis Martin <[email protected]> * Update content/nginx-one/nap-integration/add-urls.md Co-authored-by: Travis Martin <[email protected]> * Update content/nginx-one/nap-integration/add-parameters.md Co-authored-by: Travis Martin <[email protected]> * Update content/nginx-one/nap-integration/add-parameters.md Co-authored-by: Travis Martin <[email protected]> * Update content/nginx-one/nap-integration/add-signature-sets.md Co-authored-by: Travis Martin <[email protected]> * Update content/nginx-one/nap-integration/add-urls.md Co-authored-by: Travis Martin <[email protected]> * address feedback * change headings * address feedback * add changelog for new WAF release --------- Co-authored-by: Mike Jang <[email protected]> Co-authored-by: Travis Martin <[email protected]>
1 parent ecbd93b commit f714583

File tree

8 files changed

+378
-5
lines changed

8 files changed

+378
-5
lines changed

‎content/nginx-one/changelog.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,19 @@ h2 {
3030

3131
Stay up-to-date with what's new and improved in the F5 NGINX One Console.
3232

33+
## October 6, 2025
34+
35+
### Expanded features for configuring NGINX security policies with F5 WAF
36+
37+
You can now configure the following for F5 WAF policies directly in the NGINX One Console:
38+
- [Signature Sets]({{< ref "/nginx-one/nap-integration/add-signature-sets.md" >}})
39+
- [Signature Exceptions]({{< ref "/nginx-one/nap-integration/add-signature-sets.md#exceptions" >}})
40+
- [Parameters]({{< ref "/nginx-one/nap-integration/cookies-params-urls.md#add-parameters" >}})
41+
- [URLs]({{< ref "/nginx-one/nap-integration/cookies-params-urls.md#add-urls" >}})
42+
- [Cookies]({{< ref "/nginx-one/nap-integration/cookies-params-urls.md#add-cookies" >}})
43+
44+
For more details, see the [F5 WAF Integration Guide ]({{< ref "/nginx-one/nap-integration/" >}}).
45+
3346
## October 2, 2025
3447

3548
### You can now set up config templates

‎content/nginx-one/nap-integration/add-signature-sets.md‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
---
2+
title: "Add signature sets and exceptions"
3+
weight: 300
4+
toc: true
5+
nd-content-type: how-to
6+
nd-product: NGINX One Console
7+
---
8+
9+
This document describes how you can configure signature sets and signature exceptions in F5 WAF for NGINX policies. When you add a policy, NGINX One Console provides options to customize attack signatures to better protect your applications.
10+
11+
## Understanding signature sets and exceptions
12+
13+
Attack signatures are rules or patterns that identify attack sequences or classes of attacks on a web application. F5 WAF for NGINX includes predefined attack signatures grouped into signature sets.
14+
15+
### Signature set
16+
17+
A **signature set** is a collection of attack signatures with a specific name and purpose. These sets are predefined and can be enabled or disabled in your policy.
18+
19+
For example, you might have sets for SQL Injection Signatures, Cross-Site Scripting Signatures, or Buffer Overflow Signatures.
20+
21+
### Signature exception
22+
23+
A **signature exception** allows you to explicitly enable or disable individual attack signatures within a set. This gives you granular control over your policy. For example:
24+
- If a signature in a set causes false positives (blocking legitimate traffic), you can create an exception to disable just that signature while keeping the rest of the set active.
25+
- If you want to enable blocking for one specific attack signature rather than an entire set, you can create an exception to enable just that signature.
26+
27+
## Add signature sets
28+
29+
From NGINX One Console, select **App Protect > Policies**. In the screen that appears, select **Add Policy**. That action opens a screen where you can:
30+
31+
1. In **General Settings**, name and describe the policy.
32+
1. Go to the **Web Protection** section and select **Attack Signature Sets**. Here, you can:
33+
- View all enabled attack signature sets, including the default ones
34+
- Add new signature sets
35+
- Modify existing signature sets
36+
37+
### Configure signature sets
38+
39+
For each signature set, you can configure:
40+
- **Alarm**: When enabled, matching requests are logged
41+
- **Block**: When enabled, matching requests are blocked
42+
43+
For example, to configure Buffer Overflow Signatures to log but not block:
44+
45+
```json
46+
{
47+
"policy": {
48+
"name": "buffer_overflow_signature",
49+
"template": { "name": "POLICY_TEMPLATE_NGINX_BASE" },
50+
"signature-sets": [
51+
{
52+
"name": "Buffer Overflow Signatures",
53+
"alarm": true,
54+
"block": false
55+
}
56+
]
57+
}
58+
}
59+
```
60+
61+
### Remove signature sets
62+
63+
To remove a signature set from your policy, you have two options:
64+
65+
1. Disable the set by setting both `alarm` and `block` to `false`:
66+
67+
```json
68+
{
69+
"policy": {
70+
"name": "no_xpath_policy",
71+
"template": { "name": "POLICY_TEMPLATE_NGINX_BASE" },
72+
"signature-sets": [
73+
{
74+
"name": "XPath Injection Signatures",
75+
"block": false,
76+
"alarm": false
77+
}
78+
]
79+
}
80+
}
81+
```
82+
83+
1. Use the `$action` meta-property to delete the set (preferred for better performance):
84+
85+
```json
86+
{
87+
"policy": {
88+
"name": "no_xpath_policy",
89+
"template": { "name": "POLICY_TEMPLATE_NGINX_BASE" },
90+
"signature-sets": [
91+
{
92+
"name": "XPath Injection Signatures",
93+
"$action": "delete"
94+
}
95+
]
96+
}
97+
}
98+
```
99+
100+
## Add signature exceptions
101+
102+
From the **Web Protection** section, select **Attack Signature Exceptions**. This allows you to override settings for individual signatures.
103+
104+
1. Click **Add Item** to create a new exception.
105+
1. Select the signature(s) you want to modify.
106+
1. Configure the exception. For example, to disable a specific signature:
107+
108+
```json
109+
{
110+
"signatures": [
111+
{
112+
"name": "_mem_bin access",
113+
"enabled": false,
114+
"signatureId": 200100022
115+
}
116+
]
117+
}
118+
```
119+
120+
## Add and deploy your policy
121+
122+
After configuring signature sets and exceptions:
123+
124+
1. Select **Add Policy**. The policy JSON will be updated with your changes.
125+
1. Your policy will appear in the list under the name you provided.
126+
1. You can then [deploy]({{< ref "/nginx-one/nap-integration/deploy-policy.md/" >}}) the policy to either:
127+
- An instance
128+
- A Config Sync Group
129+
130+
From NGINX One Console, you can [review and modify]({{< ref "/nginx-one/nap-integration/review-policy.md/" >}}) your saved policies at any time by selecting **App Protect > Policies**.
131+
132+
For a complete list of available signature sets and detailed information about attack signatures, see the [Attack Signatures]({{< ref "/waf/policies/attack-signatures.md" >}}) documentation.

‎content/nginx-one/nap-integration/cookies-params-urls.md‎

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
---
2+
title: "Add cookies, parameters and URLs"
3+
weight: 400
4+
toc: true
5+
nd-content-type: how-to
6+
nd-product: NGINX One Console
7+
---
8+
9+
# Add cookies
10+
11+
Cookie protections can be configured and managed directly within the policy editor by selecting the **Cookies** option.
12+
13+
## Cookie properties and types
14+
15+
Each cookie configuration includes:
16+
- `Cookie Type`: `Explicit` or `Wildcard`. For details on explicit and wildcard matching, see the [Matching Types: Explicit vs Wildcard]({{< ref "/nginx-one/nap-integration/waf-policy-matching-types.md" >}}) section.
17+
- `Cookie Name`: The name of the cookie to be monitored or protected
18+
- `Enforcement Type`:
19+
- **Allow**: Specifies that this cookie may be changed by the client. The cookie is not protected from modification
20+
- **Enforce**: Specifies that this cookie may not be changed by the client
21+
- `Attack Signatures`: Indicates whether attack signatures and threat campaigns are enabled, disabled, or not applicable
22+
- `Mask value in logs`: When enabled, the cookie's value will be masked in the request log for enhanced security and privacy
23+
24+
For a complete list of configurable cookie properties and options, see the [Cookie Configuration Parameters]({{< ref "/waf/policies/parameter-reference.md" >}}) documentation under the `cookies` section.
25+
26+
## Cookie violations
27+
28+
Select **Edit Configuration** to configure cookie violations. The following violations can be configured for cookies:
29+
30+
- `VIOL_COOKIE_EXPIRED`: Triggered when a cookie's timestamp is expired
31+
- `VIOL_COOKIE_LENGTH`: Triggered when cookie length exceeds the configured limit
32+
- `VIOL_COOKIE_MALFORMED`: Triggered when cookies are not RFC-compliant
33+
- `VIOL_COOKIE_MODIFIED`: Triggered when domain cookies have been tampered with
34+
35+
For each violation type, you can:
36+
- Set the enforcement action
37+
- Toggle `Alarm`, `Alarm and Block`, or `Disabled` settings
38+
39+
For more details about enforcement modes, see the [Glossary]({{< ref "/nginx-one/glossary.md#nginx-app-protect-waf-terminology" >}}), specifically the entry: **Enforcement mode**.
40+
41+
See the [Supported Violations]({{< ref "/waf/policies/violations.md#supported-violations" >}}) for additional details.
42+
43+
## Add a cookie to your policy
44+
45+
1. Choose Cookie Type:
46+
- Select either `Explicit` for exact cookie matching or `Wildcard` for pattern-based matching
47+
48+
1. Configure Basic Properties:
49+
- Enter the `Cookie Name`
50+
- Choose whether to mask the cookie value in logs
51+
52+
1. Set Enforcement Type:
53+
- Choose either `Allow` or `Enforce`
54+
55+
1. Optional: Configure Attack Signatures
56+
- If enabled, you can overwrite attack signatures for this specific cookie
57+
- For details on signature configuration, refer to the documentation on [Add Signature Sets]({{< ref "/nginx-one/nap-integration/add-signature-sets.md/" >}})
58+
59+
1. Select **Add Cookie** to save your configuration
60+
61+
# Add parameters
62+
63+
Parameter protections can be configured and managed directly within the policy editor by selecting the **Parameters** option.
64+
65+
## Parameter properties and types
66+
67+
Each parameter configuration includes:
68+
- `Parameter Type`: `Explicit` or `Wildcard`. For details on explicit and wildcard matching, see the [Matching Types: Explicit vs Wildcard]({{< ref "/nginx-one/nap-integration/waf-policy-matching-types.md" >}}) section.
69+
- `Parameter Name`: The name of the parameter
70+
- `Location`: Where the parameter is expected (URL query string, POST data, etc.)
71+
- `Value Type`: The expected type of the parameter value (e.g., alpha-numeric, integer, email)
72+
- `Attack Signatures`: Whether attack signature checking is enabled for this parameter
73+
- `Mask value in logs`: When enabled, the parameter's value will be masked in the request log for enhanced security and privacy. This sets `sensitiveParameter` property of the parameter item.
74+
75+
For a complete list of configurable parameter properties and options, see the [Parameter Configuration Parameters]({{< ref "/waf/policies/parameter-reference.md" >}}) documentation under the `parameters` section.
76+
77+
## Parameter violations
78+
79+
Select **Edit Configuration** to configure parameter violations. The following violations can be configured for parameters:
80+
81+
- `VIOL_PARAMETER`: Triggered when an illegal parameter is detected
82+
- `VIOL_PARAMETER_ARRAY_VALUE`: Triggered when an array parameter value is illegal
83+
- `VIOL_PARAMETER_DATA_TYPE`: Triggered when parameter data type doesn't match configured security policy
84+
- `VIOL_PARAMETER_EMPTY_VALUE`: Triggered when a parameter value is empty but shouldn't be
85+
- `VIOL_PARAMETER_LOCATION`: Triggered when a parameter is found in wrong location
86+
- `VIOL_PARAMETER_MULTIPART_NULL_VALUE`: Triggered when the multi-part request has a parameter value that contains the NULL character (0x00)
87+
- `VIOL_PARAMETER_NAME_METACHAR`: Triggered when illegal meta characters are found in parameter name
88+
- `VIOL_PARAMETER_NUMERIC_VALUE`: Triggered when numeric parameter value is outside allowed range
89+
- `VIOL_PARAMETER_REPEATED`: Triggered when a parameter name is repeated illegally
90+
- `VIOL_PARAMETER_STATIC_VALUE`: Triggered when a static parameter value doesn't match configured security policy
91+
- `VIOL_PARAMETER_VALUE_BASE64`: Triggered when the value is not a valid Base64 string
92+
- `VIOL_PARAMETER_VALUE_LENGTH`: Triggered when parameter value length exceeds limits
93+
- `VIOL_PARAMETER_VALUE_METACHAR`: Triggered when illegal meta characters are found in parameter value
94+
- `VIOL_PARAMETER_VALUE_REGEXP`: Triggered when parameter value doesn't match required pattern
95+
96+
For each violation type, you can:
97+
- Set the enforcement action
98+
- Toggle `Alarm`, `Alarm and Block`, or `Disabled` settings
99+
100+
For more details about enforcement modes, see the [Glossary]({{< ref "/nginx-one/glossary.md#nginx-app-protect-waf-terminology" >}}), specifically the entry: **Enforcement mode**.
101+
102+
See the [Supported Violations]({{< ref "/waf/policies/violations.md#supported-violations" >}}) for additional details.
103+
104+
## Add a parameter to your policy
105+
106+
1. Choose Parameter Type:
107+
- Select either `Explicit` for exact parameter matching or `Wildcard` for pattern-based matching
108+
109+
1. Configure Basic Properties:
110+
- Enter the parameter `Parameter Name`
111+
- Select the `Location` where the parameter is expected
112+
- Choose the `Value Type` (alpha-numeric, integer, email, etc.)
113+
- Set the `Data Type` if applicable
114+
115+
1. Set Security Options:
116+
- Choose whether to enable attack signatures
117+
118+
{{< call-out "important" >}}
119+
120+
Attack Signatures are only applicable when the Value Type is `User Input` or `Array` **and** the Data Type is either `Alphanumeric` or `Binary`
121+
122+
{{< /call-out >}}
123+
124+
- Decide if parameter value should be masked in logs which sets `sensitiveParameter` in [Parameter Configuration Reference]({{< ref "/waf/policies/parameter-reference.md" >}})
125+
126+
1. Optional: Configure Attack Signatures
127+
- If enabled, you can overwrite attack signatures for this specific parameter
128+
- For details on signature configuration, refer to the documentation on [Add Signature Sets]({{< ref "/nginx-one/nap-integration/add-signature-sets.md/" >}})
129+
130+
1. Select **Add Parameter** to save your configuration
131+
132+
# Add URLs
133+
134+
URL protections can be configured and managed directly within the policy editor by selecting the **URLs** option.
135+
136+
## URL properties and types
137+
138+
Each URL configuration includes:
139+
- `URL Type`: `Explicit` or `Wildcard`. For details on explicit and wildcard matching, see the [Matching Types: Explicit vs Wildcard]({{< ref "/nginx-one/nap-integration/waf-policy-matching-types.md" >}}) section.
140+
- `Method`: Specifies the HTTP method(s) for the URL (`GET`, `POST`, `PUT`, etc.)
141+
- `Protocol`: The protocol for the URL (`HTTP`/`HTTPS`)
142+
- `Enforcement Type`:
143+
- **Allow**: Permits access to the URL with optional attack signature checks
144+
- **Disallow**: Blocks access to the URL entirely
145+
- `Attack Signatures`: Indicates whether attack signatures and threat campaigns are enabled, disabled, or not applicable
146+
147+
{{< call-out "important" >}}
148+
149+
**⚠️ Important:** Attack Signatures are automatically shown as "Not Applicable" when Enforcement Type is set to `Disallow` since the URL is explicitly blocked and signature checking is unnecessary.
150+
151+
{{< /call-out >}}
152+
153+
For a complete list of configurable URL properties and options, see the [URL Configuration Parameters]({{< ref "/waf/policies/parameter-reference.md" >}}) documentation under the `urls` section.
154+
155+
## URL violations
156+
157+
Select **Edit Configuration** to configure URL violations. The following violations can be configured for URLs:
158+
159+
- `VIOL_URL`: Triggered when an illegal URL is accessed
160+
- `VIOL_URL_CONTENT_TYPE`: Triggered when there's an illegal request content type
161+
- `VIOL_URL_LENGTH`: Triggered when URL length exceeds the configured limit
162+
- `VIOL_URL_METACHAR`: Triggered when illegal meta characters are found in the URL
163+
164+
For each violation type, you can:
165+
- Set the enforcement action
166+
- Toggle `Alarm`, `Alarm and Block`, or `Disabled` settings
167+
168+
For more details about enforcement modes, see the [Glossary]({{< ref "/nginx-one/glossary.md#nginx-app-protect-waf-terminology" >}}), specifically the entry: **Enforcement mode**.
169+
170+
See the [Supported Violations]({{< ref "/waf/policies/violations.md#supported-violations" >}}) for additional details.
171+
172+
## Add a URL to your policy
173+
174+
1. Choose URL Type:
175+
- Select either `Explicit` for exact URL matching or `Wildcard` for pattern-based matching
176+
177+
1. Configure Basic Properties:
178+
- Enter the `URL` path (e.g., `/index.html`, `/api/data`)
179+
- The URL path must start with `/`
180+
- Select HTTP `Method(s)` (e.g., `GET`, `POST`, *)
181+
- Choose the `Protocol` (`HTTP`/`HTTPS`)
182+
183+
1. Set Enforcement:
184+
- Choose whether to allow or disallow the URL
185+
- If `Allow URL` is selected, you can optionally enable attack signatures
186+
187+
{{< call-out "important" >}}
188+
189+
**⚠️ Important:** Attack signatures cannot be enabled for disallowed URLs.
190+
191+
{{< /call-out >}}
192+
193+
1. **Optional**: Configure Attack Signatures
194+
- If enabled, you can overwrite attack signatures for this specific URL
195+
- For details on signature configuration, refer to the documentation on [Add Signature Sets]({{< ref "/nginx-one/nap-integration/add-signature-sets.md/" >}})
196+
197+
1. Select **Add URL** to save your configuration

‎content/nginx-one/nap-integration/deploy-policy.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# We use sentence case and present imperative tone
33
title: "Deploy policy"
44
# Weights are assigned in increments of 100: determines sorting order
5-
weight: 400
5+
weight: 600
66
# Creates a table of contents and sidebar, useful for large documents
77
toc: false
88
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this

‎content/nginx-one/nap-integration/overview.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,4 +43,4 @@ F5 WAF for NGINX has specific requirements for the configuration with Docker con
4343
- You'll need to set a policy bundle (in compressed tar format) in a configured `volume`.
4444
- Make sure the directory for [NGINX Agent]({{< ref "/agent/configuration/" >}}) includes `/etc/nginx/app_protect_policies`.
4545

46-
When you deploy NAP policy through NGINX One Console, do not also use plain JSON policy in the same NGINX instance.
46+
When you deploy NAP policy through NGINX One Console, do not also use plain JSON policy in the same NGINX instance.

‎content/nginx-one/nap-integration/review-policy.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# We use sentence case and present imperative tone
33
title: "Review policy"
44
# Weights are assigned in increments of 100: determines sorting order
5-
weight: 300
5+
weight: 500
66
# Creates a table of contents and sidebar, useful for large documents
77
toc: false
88
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
@@ -37,4 +37,3 @@ From the NGINX One Console, you can also manage existing policies. In the Polici
3737
{{< call-out "note" >}}
3838
If you use **Save As** to create a new policy, include the `app_protect_cookie_seed` [directive]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#directives" >}}).
3939
{{< /call-out >}}
40-

‎content/nginx-one/nap-integration/security-policy-api.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: "Set security policies through the API"
3-
weight: 700
3+
weight: 800
44
toc: true
55
type: reference
66
product: NGINX One

0 commit comments

Comments
 (0)