Managing Application Protection Policies¶
Scenario¶
Application protection policies can be added, edited, and deleted in the following scenarios:
Addition: HSS provides a default policy, which contains all the detection rules for application protection. If you need to customize the policy for a server, you can add a protection policy and customize the detection rules and configurations in the policy.
Editing: You can edit a custom protection policy.
Deletion: You can delete a custom protection policy that is not associated with any server.
Adding a Protection Policy¶
Log in to the management console.
Click
in the upper left corner of the page, select a region, and choose Security > Host Security Service. The HSS page is displayed.Choose PreventionApplication Protection and click Protection Policies. For more information, see Table 1.
Note
If your servers are managed by enterprise projects, you can select an enterprise project to view or operate the asset and scan information.
Figure 1 Viewing the protection policies¶
Table 1 Protection policy parameters¶ Parameter
Description
Policy Name
Protection policy name
Detection Rule
Detection rules supported by a policy.
Associated Servers
Number of servers bound to a policy.
Click Add Policy. In the dialog box that is displayed, configure the parameters by referring to Table 2.
Figure 2 Adding a protection policy¶
Table 2 Application protection policy parameters¶ Parameter
Description
Policy Name
User-defined policy name
Enabled
Whether to enable a detection rule for the current policy. You can select detection rules to enable them as required.
Detection Rule ID
ID of a detection rule.
Action
Protection action of a detection rule.
Detect: Detects objects based on the target rule and reports alarms for detected risk events.
Detect and block: Detects objects based on the target rule, reports alarms for detected risk events, and directly blocks or intercepts detected risk items.
Important
NOTICE: Blocking or interception may interrupt services. Exercise caution when enabling this function
Description
Description about the detected object and behavior of the target protection policy.
Click Configure in the Operation column of a detection rule to modify the rule content. Table 3 describes the supported detection rules.
Table 3 Detection rules that can be configured only¶ Rule
Description
Example
XXE
User-defined XXE blacklist protocol
.xml;.dtd;
XSS
User-defined XSS shielding rules
xml;doctype;xmlns;import;entity
WebShellUpload
User-defined suffix of files in the blacklist.
.jspx;.jsp;.jar;.phtml;.asp;.php;.ascx;.ashx;.cer
FileDirAccess
User-defined path of files in the blacklist.
/etc/passwd;/etc/shadow;/etc/gshadow;
Confirm the configured policy and selected detection rules, and click OK. You can check whether the rule is added on the Protection Policy tab page.
Editing a Protection Policy¶
Log in to the management console and go to the HSS page.
Choose PreventionApplication Protection and click Protection Policies. For more information, see Table 4.
Note
If your servers are managed by enterprise projects, you can select an enterprise project to view or operate the asset and scan information.
Figure 3 Viewing the protection policies¶
Table 4 Protection policy parameters¶ Parameter
Description
Policy Name
Protection policy name
Detection Rule
Detection rules supported by a policy.
Associated Servers
Number of servers bound to a policy.
Click Edit in the Operation column of a policy to configure the policy name, supported detection rules, and rule content.
Table 5 Application protection policy parameters¶ Parameter
Description
Policy Name
User-defined policy name
Enabled
Whether to enable a detection rule for the current policy. You can select detection rules to enable them as required.
Detection Rule ID
ID of a detection rule.
Action
Protection action of a detection rule.
Detect: Detects objects based on the target rule and reports alarms for detected risk events.
Detect and block: Detects objects based on the target rule, reports alarms for detected risk events, and directly blocks or intercepts detected risk items.
Important
NOTICE: Blocking or interception may interrupt services. Exercise caution when enabling this function
Description
Description about the detected object and behavior of the target protection policy.
Confirm the configured rule and selected detection items and click OK. You can check whether the target policy is modified on the Protection Policy tab page.
Deleting a Policy¶
Log in to the management console and go to the HSS page.
Choose PreventionApplication Protection and click Protection Policies. For more information, see Table 6.
Note
If your servers are managed by enterprise projects, you can select an enterprise project to view or operate the asset and scan information.
Figure 4 Viewing the protection policies¶
Table 6 Protection policy parameters¶ Parameter
Description
Policy Name
Protection policy name
Detection Rule
Detection rules supported by a policy.
Associated Servers
Number of servers bound to a policy.
Click Delete in the Operation column of the target policy. In the dialog box that is displayed, confirm the policy information and click OK.
Important
Only the policies that are not associated with any server can be deleted.