Overriding managed rulesets

Overriding workflow (API)

To apply an override for a managed ruleset, take the following steps.

1. List the rulesets available by using the list rulesets operation.

2. List the rules for that ruleset by using the get ruleset operation.

3. Call the update ruleset operation on your phase entry point.

4. Specify the overrides in the action_parameters of the rule that executes your managed ruleset.

   "action_parameters": {
     "id": "<RULESET_ID>",
     "overrides": {
       // ruleset overrides
       "property-to-modify": "value",
       "property-to-modify": "value",
       // tag overrides
       "categories": [
         {
           "category": "<TAG_NAME>",
           "property-to-modify": "value",
           "property-to-modify": "value"
         }
       ],
       // rule overrides
       "rules": [
         {
           "id": "<RULE_ID>",
           "property-to-modify": "value",
           "property-to-modify": "value"
         }
       ]
     }
   }
   

You can override the following rule properties.

• "action"
• "enabled"

Some managed rulesets can have extra override requirements, or they might override other rule properties.

It is not effective to enable all the rules in a managed ruleset at the instance level by using an override. This change can affect all the zones in your instance. Some rules are disabled by default because they eventually affect legitimate traffic. Do not enable these rules across zones without previous consideration.

Overriding managed rulesets in the console

To override a managed ruleset in the console, follow these steps:

1. In the CIS console, navigate to the Security section.

2. Select the WAF tab.

3. Click the name of the ruleset that you want override.

4. From the Configure deployment side panel, click Browse rules.

5. In the Override CIS Managed Ruleset rules side panel, you can:

   • Select an action for any rule that you want to override.
   • Select the Status toggle to enable or disable a rule.

6. After you have reconfigured the ruleset rules, click Continue.

7. Verify the list of rules to override, then click Save.

   Click Reset to default to restore the original settings.

Listing managed rulesets from the CLI

To list all zone rulesets from the CLI, run the following command:

ibmcloud cis managed-waf rulesets DNS_DOMAIN_ID [-i, --instance INSTANCE] [--output FORMAT]

Listing rules under a zone ruleset from the CLI

To list the rules under a zone ruleset from the CLI, run the following command:

ibmcloud cis managed-waf ruleset DNS_DOMAIN_ID RULESET_ID [-i, --instance INSTANCE] [--output FORMAT]

Overriding managed rulesets from the CLI

To override a managed WAF ruleset from the CLI, run the following command:

ibmcloud cis managed-waf deployment-add-ruleset DNS_DOMAIN_ID RULESET_ID [--match EXPRESSION] [--enabled true|false] [--override-action ACTION] [--override-status STATUS] [--paranoia-level LEVEL] [--override-rules RULE] [-i, --instance INSTANCE] [--output FORMAT]

Listing zone rulesets from the API

To list all zone rulesets from the API, run the following command:

curl -X GET \
  https://api.cis.cloud.ibm.com/v1/$CRN/zones/$ZONE_ID/rulesets \
  -H 'content-type: application/json' \
  -H 'accept: application/json' \
  -H 'x-auth-user-token: Bearer xxxxxx'

Listing all rules for a ruleset from the API

To list all rules for a specific ruleset, run the following command:

curl -X GET \
  https://api.cis.cloud.ibm.com/v1/$CRN/zones/$ZONE_ID/rulesets/$RULESET_ID \
  -H 'content-type: application/json' \
  -H 'accept: application/json' \
  -H 'x-auth-user-token: Bearer xxxxxx'

Where:

• $RULESET_ID is the ID of the managed ruleset which the rules are listed for.

Overriding an entry point ruleset from the API

To update the entry point ruleset from the API with an override, run the following command:

curl -X PUT \
  https://api.cis.cloud.ibm.com/v1/$CRN/zones/$ZONE_ID/rulesets/phases/$RULESET_PHASE/entrypoint \
  -H 'content-type: application/json' \
  -H 'accept: application/json' \
  -H 'x-auth-user-token: Bearer xxxxxx' \
  -d '{"description":"Deploy managed ruleset, enabling a specific rule with log action","rules":[{"action":"execute","expression":"true","action_parameters":{"id":"<MANAGED_RULESET_ID>","overrides":{"rules":[{"id":"<RULE_ID>","enabled":true,"action":"log"}]}}}]}'

Where:

• $RULESET_PHASE is the ruleset phase that is deployed to. Use http_request_firewall_managed to override managed WAF rulesets.
• -d is the object of attributes that are required to create the ruleset.
  • description defines your own summary of what a ruleset is accomplishing.
  • rules is the array of rules to deploy with the ruleset.
    • action is the action for the rule to take. See WAF ruleset actions for a description of available actions.
    • action_parameters is the object for defining what the action operates on.
      • id is the ID of the ruleset to execute. This ID is retrieved from the list zone rulesets operation.
      • overrides is the object of overrides to set upon the selected ruleset.
        • rules is the list of rules that are overridden with the selected properties.
          • id is the ID of the rule to override. This ID is retrieved from the list zone ruleset rules operation.
          • enabled overwrites even when the rule is enabled.
          • action specifies the overridden action that the rule takes.
    • expression is the condition under which the rule runs. Using "true" means that this rule always runs.
    • description defines your own summary of what the rule is accomplishing.

Listing managed rulesets with Terraform

The following example lists all managed rulesets using Terraform:

data "ibm_cis_rulesets" "tests" {
    cis_id    = ibm_cis.instance.id
    domain_id = data.ibm_cis_domain.cis_domain.domain_id
}

For more information about the arguments and attributes, see ibm_cis_rulesets in the Terraform registry.

Listing all rules of a managed ruleset with Terraform

The following example lists all rules of a managed ruleset using Terraform:

resource "ibm_cis_ruleset" "config" {
    cis_id    = ibm_cis.instance.id
    domain_id = data.ibm_cis_domain.cis_domain.domain_id
    ruleset_id = "943c5da120114ea5831dc1edf8b6f769"
}

For more information about the arguments and attributes, see ibm_cis_ruleset in the Terraform registry.

Overriding a rule with Terraform

This example shows how to deploy the CIS managed ruleset with various overrides. First, it enables and blocks traffic for all rules. Then, it enables and blocks traffic for a specific rule. Finally, it enables and blocks traffic for all rules in the wordpress category. Essentially, this example illustrates the different methods for overriding deployed rules (global, specific, by category).

  resource "ibm_cis_ruleset_entrypoint_version" "test" {
    cis_id    = ibm_cis.instance.id
    domain_id = data.ibm_cis_domain.cis_domain.domain_id
    phase = "http_request_firewall_managed"
    rulesets {
      description = "Entrypoint ruleset for managed ruleset"
      rules {
        action =  "execute"
        description = "Deploy CIS managed ruleset"
        enabled = true
        expression = "true"
        action_parameters  {
          id = "efb7b8c949ac4650a09736fc376e9aee"
          overrides {
            action = "block"
            enabled = true
            override_rules {
              rule_id = "var.overriden_rule.id"
              enabled = true
              action = "block"
            }
            categories {
              category = "wordpress"
              enabled = true
              action = "block"
            }
          }
        }
      }
    }
  }

The following example shows how to create a WAF entry point and override a rule with Terraform:

resource "ibm_cis_ruleset_entrypoint_version" "waf_config" {
  cis_id    = ibm_cis.instance.id
  domain_id = data.ibm_cis_domain.cis_domain.domain_id
  phase = "http_request_firewall_managed"
  rulesets {
     description = "Entry Point rulesets"
  }
  lifecycle {
      ignore_changes = [
        rulesets
      ]
  }
}

 data "ibm_cis_ruleset_entrypoint_versions" "test"{
    cis_id    = ibm_cis.instance.id
    domain_id = data.ibm_cis_domain.cis_domain.domain_id
    phase = "http_request_firewall_managed"
    depends_on = [
      ibm_cis_ruleset_entrypoint_version.waf_config
    ]
  }

resource ibm_cis_ruleset_rule "rule1" {

    cis_id    = ibm_cis.instance.id
    domain_id = data.ibm_cis_domain.cis_domain.domain_id
    ruleset_id = data.ibm_cis_ruleset_entrypoint_versions.test.rulesets[0].ruleset_id

      rule {
        action = "execute"
        description = "OWASP Core RuleSet"
        enabled = true
        expression = "true"
        action_parameters {
            id = "4814384a9e5d4991b9815dcfc25d2f1f"
            overrides {
            categories {
                 category = "paranoia-level-2"
                 enabled = false
            }
            categories {
                 category = "paranoia-level-3"
                  enabled = false
            }
            categories {
                 category = "paranoia-level-4"
                 enabled = false
            }
            override_rules {
              rule_id         = "6179ae15870a4bb7b2d480d4843b323c"
              action          = "block"
              score_threshold = 60
              enabled = true
            }
            override_rules {
              rule_id         = "8ac8bc2a661e475d940980f9317f28e1"
              enabled         = true
            }
       }
   }
}
}

resource ibm_cis_ruleset_rule "rule2" {

    cis_id    = ibm_cis.instance.id
    domain_id = data.ibm_cis_domain.cis_domain.domain_id
    ruleset_id = data.ibm_cis_ruleset_entrypoint_versions.test.rulesets[0].ruleset_id

    rule {
      action = "execute"
      description = "CIS exposed credential ruleset"
      enabled = true
      expression = "true"
      action_parameters {
           id = "c2e184081120413c86c3ab7e14069605"
           overrides {
            override_rules {
              rule_id = "53f38cd8974a4cd3bc9a8a64fc731fb0"
              enabled = true
              action = "log"
            }
      }
      }
    }
}

resource ibm_cis_ruleset_rule "rule3" {

    cis_id    = ibm_cis.instance.id
    domain_id = data.ibm_cis_domain.cis_domain.domain_id
    ruleset_id = data.ibm_cis_ruleset_entrypoint_versions.test.rulesets[0].ruleset_id

      rule {
          action = "execute"
         description = "CIS Managed ruleset"
          enabled = true
          expression = "true"
          action_parameters {
              id = "efb7b8c949ac4650a09736fc376e9aee"
              overrides {
            override_rules {
              rule_id = "5de7edfa648c4d6891dc3e7f84534ffa"
              enabled = true
              action = "block"
            }
          }
         }
      }
}

For more information about the arguments and attributes, see ibm_cis_ruleset_entrypoint_version in the Terraform registry.