Learning Adaptive profiling Exception profiling Exception heuristics URL/Parameter Optimizers

Learning Learning a positive way of discovering the URL spaces and parameters existing on the back-end application and creating the profiles for enforcing different policies on these spaces. It results in a positive security stance Recommended way to use the "Learning" feature: > Click Start Learning. > Either manually visit the application (recommended), or crawl the application. > Let the "Adaptive Profiling" feature populate the URL and parameter profiles automatically. > Visit the created profiles and review them. If found satisfactory, click Stop Learning. > The profiles will be in "Passive" state. Look out for any false positives in the logs. Also, check the "Hits" statistics. If found satisfactory, select Lock all Profiles from the More Actions drop-down list to turn all profiles to "Active". > If "Exception Profiling" is enabled, that would take care of any missing URL spaces which went uncovered during "Adaptive profiling". > If possible, manually coalesce the learned profiles to optimize the configuration. > If your back-end application or a portion of it has changed, you can 'relearn' the space by choosing "Resume Learning from the More Actions drop-down list. Note: Ensure that learning is not running for a longer time resulting in enormous amount of profiles.

Exception profile The concept of "Exception Profiling" in the Barracuda Web Application Firewall is to apply a set of heuristics on the "violations" generated by clients, and either recommend or auto create exceptions to the policies existing on the Barracuda Web Application Firewall, so as to minimize the false positives by providing a mechanism to adjust the originally created policies. Exception profiling level 1. None 2. Low 3. Medium 4. High List of important headers to keep in mind …

URL Optimizers When learning is enabled for a web application, URL profiles and parameter profiles are created based on the traffic processed by the Barracuda Web Application Firewall according to a set of matching criteria specified in the WEBSITES > Adaptive Profiling page, Adaptive Profiling section. This may also result in populating large number of profiles with the same parameters. For example: Lets consider www.foobar.com is a web application for which Learning was enabled and resulted in the following URL profiles: www.foobar.com/abc/example1. html www.foobar.com/abc/example2. html www.foobar.com/abc/example3. html www.foobar.com/abc/example4. html ... www.foobar.com/abc/example200. html Managing huge number of profiles having same security requirement can become unnecessarily complex to handle. You can handle such issues by categorizing specific URL space and coalescing multiple URL profiles into one. The URL profiles mentioned in the example above can be coalesced as: Start Token: /abc/ End Delimiter: period/dot (.) This will coalesce all the URL profiles into one URL profile i.e. /abc/*.html. Any request sent to /abc/example1.html to /abc/example200.html will match to /abc/*.html URL profile.

Parameter Optimizers When learning is enabled for a web application, URLs and parameters are created based on the traffic processed by the Barracuda Web Application Firewall according to a set of matching criteria specified in the WEBSITES > Adaptive Profiling page, Adaptive Profiling section. This configuration may result in populating large number of profiles with the same parameters. For example: Lets consider 'Learning' was enabled for a particular service and the 'Learning Utility' creates the following parameters: param1 param2 ... param100 Managing huge number of profiles having same security requirement can become unnecessarily complex to handle. You can handle such issues by properly identifying the pattern within the parameters and coalescing multiple parameter profiles into one. The parameter profiles mentioned in the example above can be coalesced as: Start Token: param This will coalesce all parameter profiles into one i.e. param*. Click Add next to the service for which you want to add a parameter optimizer.