Advanced Bot Protection Resources

Cloud WAF Rules

There are many different Cloud WAF Rules (sometimes referred to as InCap Rules), that you can use to help make your WAF add value to your business processes.

In this section, you will find content around Cloud WAF rules and a video that will go in depth around five Cloud WAF Rules you might of not known about.  Use the Imperva rules proprietary scripting language to implement your own security, delivery, and access control rules on top of Imperva's existing security and application delivery logic.

• Cloud WAF Masterclass - Flexing with InCap Rules
  This was one of our most popular Cloud WAF webinars. Jaired Anderson provides all you need to know to make the most of your Cloud WAF rules to offer real business solutions and value.
• Flexing with InCap Rules Discussion Thread
  This discussion was kicked off by one of our Cloud WAF experts, Jaired Anderson. It includes a number of important and valuable Cloud WAF rules that you can implement today. Want to know how to achieve something with InCap rules? Add your query to this thread and see what suggestions the Community has. Maybe you'd like to share your own suggestion? We'd love to learn about it. 

FAQ's for Cloud WAF Rules

|Q. Is there a way to setup shared Rules that can be enabled for multiple sites without having to create separate rules that do the same thing for multiple websites?
|A. The framework has been created and available now to apply policy for SiteACL and whitelist to sub-account and sites. Incaprule is planned to added in this framework. As of now incaprules are not part of policy framework so these need to be manually copied or use API to copy them between sites.

|Q. Which is processed first a blacklisted IP, or a rule that was created to block an IP? Is one method more efficient than another?
|A. Incaprule are by default have alert, block or challenge actions. All rules are evaluated before action. Request matching no matching rules are allowed to origin.

|Q. Is there a way to block SQL injection at Imperva for Java based application?         
|A. There are 1000s of SQLi default rules and if needed incaprule can be used to control specific use case. Please note the rule with regex can only be applied by support team.

|Q. Can we pass the client_IP value in the header rewrite?    
|A. By default the client_ip is sent in XFF and incap_client_ip header to origin . A custom rule is not available yet. 

|Q.  If we have configured cache on the WAF, deploying new rules are they applied immediately? Usually comments are configured on static pages, and hence we do add cache on static pages, adding rules, will it be applied immediately?(Limit number of comments)
|A. Cache policies can detect possible dynamic content by learning or custom rules can help, but the incaprules are applied within few seconds across the CDN. Not sure what is the actual ask here 6. Is their a possibility to setup a rule to block udp flooding? WAF by default have DDOS protection and UDP flooding never reach origin as CWAF will pass only web traffic to origin. If the origin is non web application Infra and per IP DDOS solutions are also available

Getting Started: These are documents pulled by https://docs.imperva.com/ site to give you a more in-depth understanding on how to setup your Cloud WAF websites, rules, logs and more.