This document will guide you in quickly deploying and using Tencent Cloud WAF (Web Application Firewall). First, you need to purchase a WAF instance; then, organize your website domain information and complete the domain connection and protection configuration. Finally, you can view business and security overviews through the Overview Report to stay on top of your business's security status. You can see detailed traffic disposal information from Attack Logs, making it easy to adjust the protection configuration to meet special business needs. TCOP (Tencent Cloud Observability Platform) supports defining various alarms and alarm notification methods, enhancing business and security operation efficiency.
Step 1. Purchase an instance
You can purchase multiple WAF instances. Multi-instance management better suits your business division and management requirements and allows you to achieve nearby access and protection of multi-region active-active instances in a unified manner.
For more information on instance purchase, see Purchase Method.
For more information on instance management and renewal, see Instance Management.
Step 2. Connect your website
There are SaaS WAF and CLB WAF instances.
Note:
The access domain name must be legal and have completed the relevant record filing. For details, please refer to Domain Access Related.
Domain name connection guide for SaaS WAF
SaaS WAF allocates a CNAME for the protected domain, modifies the website's DNS resolution records, and forwards the website's incoming web requests to WAF for security protection. Using it together with security groups can prevent attackers from bypassing the WAF to directly attack the website origin server. To achieve the above feature, you need to complete the following steps:
Domain Access Guide for CLB WAF
CLB WAF associates with Tencent Cloud Layer-7 CLB (listener) cluster by your domain name, and detects and purges HTTP or HTTPS traffic that goes through the CLB instance for side-channel threats. It achieves business forwarding and security separation. To achieve this feature, you need to follow the steps below:
Step 3. Configure the protection
WAF will protect the traffic to the connected website. It has multiple detection and protection modules to help your website tackle different types of security threats. The rule engine is enabled by default, mainly used to defend against common web application attacks such as SQL injection, XSS, and web shell upload. Other protection modules need to be enabled and configured manually.
Step 4. Analyze logs
By default, WAF logs attacks only. After purchasing and activating CLS, it supports logging all access requests by domain name.
Attack log
An attack log records the time, source IP, type, and details of an attack to facilitate real-time threat check and analysis as well as protection policy adjustment, fully meeting the needs of routine security Ops and business.
Currently, attacks are displayed in a clustered manner. Logs of the same type from the same source IP within a specified period are automatically aggregated into one log, reducing your operational workload and improving efficiency. Additionally, attack logs support full-text search, fuzzy search, and combined condition search. For more details, see Attack Log.
Access Log
Access logging is used to record access logs of domain names protected by WAF. It allows you to query and download access logs generated in a user-defined log retention period (up to 180 days). This feature assists customers in complying with Cybersecurity Classified Protection Service regulations. For more details, see Access Log.
Step 5. Generate a security report
After your website is connected to WAF for protection, you can go to the WAF overview page to query the current total number of domain names, connected website conditions, instance conditions, website business and attack traffic analysis data in the last 30 days, and rule updates. The WAF overview page helps you understand the overall security status of your website business. For more information, see Access Log.
Step 6. Configure TCOP
After your website is connected to WAF protection, you can configure alarms in TCOP. When WAF detects abnormal attack traffic or business traffic, it sends you alarm notifications to keep you informed about your business security. This helps you quickly respond to anomalies and adjust WAF policies to ensure the stability and security of your business. For more details, see TCOP WAF Configuration Practice Guide.
You can configure the same domain name into instances of the same type in different regions to separate the connection configurations of forwarding and protecting resources while using the same protection policy.