In-house detection rules
The official in-house WAF detection rule set, used alongside OWASP CRS; encrypted and watermarked per installation, updated with releases. Paid, either edition.
What it solves
Generic rule sets match with regular expressions and are easy to evade with encoding and splitting tricks. The in-house detection rule set is officially maintained WAF detection that works with the control plane's own detection engine and can run alongside OWASP CRS, covering what generic rules miss; it updates with every official release.
Turning it on
The in-house detection rule set is an official, paid rule pack bought per installation in the plugin market, in either edition.
- Buy it in the plugin store and confirm the install on this control plane under My plugins.
- Select rule sets in the WAF rule library (in-house detection and OWASP CRS can both be on).
- Switch in-house detection modules on or off in the site's WAF protection; changes apply at once.
Main settings
| Setting | What it does |
|---|---|
| Rule sets | In-house detection and OWASP CRS can be enabled together |
| Detection modules | Switch by attack type, effective immediately |
| Updates | Follow official releases automatically |
Typical uses
- CRS is in place but attacks still get through: add the in-house rule set alongside it.
- With adaptive WAF: hits from the in-house detectors are never loosened automatically, so false-positive handling does not weaken them.
Limits and notes
- Rules are encrypted and watermarked per installation and only work on the control plane that bought them.
- When moving servers, rebind the purchase to the new control plane.