Configuring attack thresholds

Attack threshold configurations (also known as system site alerts) apply to an entire site and target attackers’ ability to use scripting and tooling.

How attack thresholds works

System site alerts monitor and flag IP addresses that exhibit repeat malicious behavior and then handle requests from the flagged IP addresses.

Flagging occurs when enough attacks are seen from a single IP address. More explicitly, we count the number of attack signals per IP address, and when this number reaches one of the attack thresholds, we flag and blocklist the IP address.

After an IP address has been flagged, subsequent requests that are from the flagged IP address and that are tagged with an attack signal are either blocked or logged depending on the Agent mode setting. Specifically, requests with an attack signal are blocked if the agent mode is Blocked and logged if the agent mode is Not Blocking.

By default, malicious traffic from the IP address is blocked or logged for 24 hours. You can change the default time that blocklisted IP addresses are blocked by updating the blockDurationSeconds field via our API.

Limitations and considerations

When working with attack thresholds, keep the following things in mind:

• Requests that have only been tagged with anomaly and custom signals are not counted towards flagging thresholds.
• When an IP address is flagged by any Next-Gen WAF customer, we record that IP address as a known potential bad actor and make its status known across our whole network by tagging it with the SigSci Malicious IPs (SigSci IP) anomaly signal.

Adjusting attack thresholds

The default attack thresholds are based on historical patterns that we've seen across all customers.

To raise or lower the attack thresholds, complete the following steps:

1. Log in to the Next-Gen WAF console.
2. From the Sites menu, select a site if you have more than one site.

3. From the Manage menu, select Site Settings.

4. Click Attack Thresholds.

   

5. In the 1 minute interval, 10 minute interval, and 1 hour interval fields, enter the thresholds that are appropriate for your site. To immediately block requests that are tagged with at least one attack signal, use the Immediate blocking setting.

6. Click Update.

Overriding attack thresholds

You can override the attack thresholds for individual attack signals.

Applying immediate blocking

You can use the Immediate blocking setting to immediately block all requests tagged with at least one attack signal. While Immediate blocking is enabled, your existing attack threshold settings are maintained so that you can easily revert to threshold-based blocking.

To enable immediate blocking:

1. Log in to the Next-Gen WAF console.
2. From the Sites menu, select a site if you have more than one site.
3. From the Manage menu, select Site Settings.
4. Click Attack Thresholds.
5. Click the Immediate blocking switch to the on position.