Description:
A Web Application Firewall (WAF) protects web applications by inspecting incoming HTTP/HTTPS traffic and blocking malicious requests. Utho WAF provides managed rules that help detect and block common web application attacks. The default managed rule group and its rules should be enabled to ensure the WAF actively protects the application. Utho provides a dedicated Configure Managed Rules function for its Web Application Firewall.
Rationale:
Enabling the default managed rule group and its rules provides baseline protection against common malicious web requests without requiring administrators to create every security rule manually.
Impact:
Malicious requests matching enabled managed rules may be blocked.
Legitimate application requests could be affected if a managed rule incorrectly identifies traffic as malicious.
Applications should be tested after enabling managed rules to identify any unexpected blocking.
Default Value:
The default managed rule group and its rules must be reviewed in the Utho WAF configuration. Administrators should ensure that the default managed rule group and required rules are enabled.
Pre-requisites:
A Utho account with permission to manage WAF resources.
A WAF must already exist.
A Load Balancer must be available if the WAF is being used to protect a Load Balancer.
Permission to view and modify WAF managed rules.
Remediation
Test Plan:
Using the Utho Console
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Networking → Web Application Firewall.
Locate the WAF that you want to verify.
Click Manage for the selected WAF.
Navigate to the Managed Rules section.
Review the available managed rule groups.
Locate the Default Managed Rule Group.
Verify that the Default Managed Rule Group is enabled.
Open the rules under the default managed rule group.
Verify that the required managed rules are enabled.
If the Default Managed Rule Group or any required managed rule is disabled, follow the Implementation Steps to remediate the issue.
Using the Utho API
Retrieve the WAF configuration using the Utho WAF API.
curl -s \
-H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/waf
Review the returned WAF configuration and verify that the default managed rule group and its rules are enabled. Utho's REST API provides WAF endpoints for retrieving and managing WAF resources.
Implementation Steps:
Using the Utho Console
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Networking → Web Application Firewall.
Locate the WAF that requires remediation.
Click Manage for the selected WAF.
Navigate to the Managed Rules section.
Locate the Default Managed Rule Group.
Enable the Default Managed Rule Group if it is disabled.
Review the rules under the default managed rule group.
Enable the required managed rules that are disabled.
Save the WAF configuration.
Using the Utho API
Use the Utho WAF API to retrieve the current WAF configuration before making changes.
curl -s \
-H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/waf
Use the documented Utho WAF update operation to enable the Default Managed Rule Group and its required rules.
curl -X POST \
-H "Authorization: Bearer $UTHO_API_TOKEN" \
-H "Content-Type: application/json" \
-d '<waf-managed-rule-configuration>' \
https://api.utho.com/v2/waf
Verify through the WAF configuration that the Default Managed Rule Group and its required rules are enabled.
Note: Utho's public API documentation exposes GET, POST, and DELETE operations for /waf, but it does not provide enough publicly documented request-body details to safely specify the exact managed-rule enable/disable payload. Do not use an invented JSON field or payload. Confirm the exact WAF API request format from the Utho API specification before automating the change.
Backout Plan
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Networking → Web Application Firewall.
Locate the affected WAF.
Click Manage for the selected WAF.
Navigate to the Managed Rules section.
Disable the managed rule or rule group that was enabled during remediation.
Save the WAF configuration.
References: