Skip to content

APPSEC-58494: Add threat alias to inapp waf page #30777

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jul 31, 2025
Merged

APPSEC-58494: Add threat alias to inapp waf page #30777

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
061bca1
APPSEC-58494: Add threat alias to inapp waf page
ArthurFoucher Jul 29, 2025
7eaff61
Merge branch 'master' into arthur/chore/fix-inappwaf-documentation-re…
ArthurFoucher Jul 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions content/en/security/application_security/policies/inapp_waf_rules.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,16 @@
aliases:
- /security_platform/application_security/event_rules
- /security/application_security/event_rules
- /security/application_security/threats/inapp_waf_rules
---

## Overview

With App and API Protection (AAP) enabled, the Datadog tracing library actively monitors all web services and API requests for suspicious security activity.

An _In-App WAF rule_ specifies conditions on the incoming request to define what the library considers suspicious. The Datadog tracing library includes hundreds of out-of-the-box AAP In-App WAF rules, which are used to display security traces in the trace explorer and in the default signal rules.
An _In-App WAF rule_ specifies conditions on the incoming request to define what the library considers suspicious. The Datadog tracing library includes hundreds of out-of-the-box AAP In-App WAF rules, which are used to display security traces in the trace explorer and in the default signal rules.

Check notice on line 13 in content/en/security/application_security/policies/inapp_waf_rules.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.sentencelength 

Suggestion: Try to keep your sentence length to 25 words or fewer.

You can add to the In-App WAF rules without upgrading the tracing library.
You can add to the In-App WAF rules without upgrading the tracing library.

## Structure of an AAP In-App WAF rule

Expand All @@ -33,7 +34,7 @@
| `server.request.body` | The parsed HTTP body (key/value map) | `data.items[0] => value0, data.items[1] => value1` |
| `server.response.status` | The http status code | `200` |

#### Operators
#### Operators

| name | Description |
|------|-------------|
Expand All @@ -46,7 +47,7 @@

Custom In-App WAF rules enable users to log or block specific types of requests to their applications. For example, you can use custom rules to monitor login success or failure. To get started, navigate to **Security** -> **App and API Protection** -> **Policies** -> **In-App WAF** -> [**Custom Rules**][4].

**Note:** Default rules in In-App WAF are read-only. To refine your In-App WAF behavior, modify the In-App WAF rules. Default rules cannot be modified, however, you can create a custom rule based on one of the default rules, and modify the match conditions to your needs. Be sure to disable the default rule so that you don't have two similar rules evaluating the same requests.
**Note:** Default rules in In-App WAF are read-only. To refine your In-App WAF behavior, modify the In-App WAF rules. Default rules cannot be modified, however, you can create a custom rule based on one of the default rules, and modify the match conditions to your needs. Be sure to disable the default rule so that you don't have two similar rules evaluating the same requests.

Check notice on line 50 in content/en/security/application_security/policies/inapp_waf_rules.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.sentencelength 

Suggestion: Try to keep your sentence length to 25 words or fewer.

## Configure an AAP In-App WAF rule

Expand Down Expand Up @@ -97,7 +98,7 @@

4. Using a utility such as SCP or FTP, copy the `appsec-rules.json` file to your application server, for example, `/home/asm/appsec-rules.json`.

5. Following the instructions in [Enabling AAP][3] for adding application variables in your environment, add the `DD_APPSEC_RULES` environment variable to your service with the full path to the file:
5. Following the instructions in [Enabling AAP][3] for adding application variables in your environment, add the `DD_APPSEC_RULES` environment variable to your service with the full path to the file:
```
DD_APPSEC_RULES=/home/asm/appsec-rules.json
```
Expand All @@ -106,7 +107,7 @@

## What to do next

Next, [configure detection rules to create security signals][1] based on those security traces defined by the In-App WAF rules you created. You can modify the provided out-of-the-box AAP detection rules or create new ones.
Next, [configure detection rules to create security signals][1] based on those security traces defined by the In-App WAF rules you created. You can modify the provided out-of-the-box AAP detection rules or create new ones.

[1]: /security/application_security/policies/custom_rules/
[2]: https://app.datadoghq.com/security/appsec/in-app-waf
Expand Down
Loading