AWS WAFv2 Web ACL (WAF Classic not supported).Access keys can be associated with an access policy that restricts access based on the source IP. The ThreatSTOP cloud performs policy updates through the AWS API.For instance if you take the defaults and assign 30 block IPSets and 1 allow, the resulting policy can contain up to 300k block rules (subnets) and 10k allow rules. The maximum size of the ThreatSTOP policy that can be loaded on the AWS WAF is correlated to the # of block/allow IPSets configured in the integration.If you need protection for other endpoint types, please contact ThreatSTOP Support for assitance selecting the right product for your specific environment. The Web Application Firewalls (WAF) only protect endpoints for HTTP/HTTPs traffic.This is useful for validating a policy without enforcing filtering. The default ‘BLOCK’ of course blocks the request, while ‘COUNT’ allows the request but logs the event. The integration supports a monitoring mode by changing the block action to ‘COUNT’.Any managed rule(s) for things like SQL Injection Protection, or other custom rules will not be touched so long as they are named differently than the ThreatSTOP rule naming convention (e.g.
Each IPSet is capable of supporting 10,000 IP Addresses/CIDRs. Each rule can have multiple predicates (IPSet Match Groups) using the ‘OR’ operator.
0 kommentar(er)
