IncapRules are an integral method to customize Incapsula for your specific applications and environment. However, we find that our enterprise clients may have questions on building advanced rules or need help understanding how to write them for complex scenarios. In this session, Jeff Serota, Technical Account Manager, discusses the interface, some of the most common filters and actions, and how a large client collaborated with our security team to thwart credential stuffing on their client self-service portal.

1. Using IncapRules to
Customize Your Security
and Access Control
Jeff Serota
Technical Account Manager, Imperva

2. © 2016 Imperva, Inc. All rights reserved.
Audience Poll
How many organizations use IncapRules
in production today?
© 2017 Imperva, Inc. All rights reserved.2

3. © 2016 Imperva, Inc. All rights reserved.
Audience Poll
How many IncapRules do you have defined?
a) 0 – 5
b) 5 – 10
c) 10 – 50
d) 50+
© 2017 Imperva, Inc. All rights reserved.3

4. © 2016 Imperva, Inc. All rights reserved. © 2017 Imperva, Inc. All rights reserved.4

5. © 2016 Imperva, Inc. All rights reserved.
IncapRules to the Rescue!
© 2017 Imperva, Inc. All rights reserved.5

6. © 2016 Imperva, Inc. All rights reserved.
What are IncapRules?
• IncapRules are a proprietary language for building custom security rules
• Rules are built using Filters, Operators, and Values and combined
using Boolean logic
• If a rule evaluates to True, an Action is taken
Filter Operator Value Filter Operator Value
Predicate and Predicate
URL contains ″˄/admin″ & ClientIP != 168.132.54.5
© 2017 Imperva, Inc. All rights reserved.6

7. © 2016 Imperva, Inc. All rights reserved. © 2017 Imperva, Inc. All rights reserved.7

8. © 2016 Imperva, Inc. All rights reserved.
Actions
Anatomy of IncapRules
© 2017 Imperva, Inc. All rights reserved.8

9. © 2016 Imperva, Inc. All rights reserved.
Actions
Challenge
Require the client to pass a
Cookie, JavaScript, or CAPTCHA
challenge in order to
complete the request
Alert
Generate a non-blocking
alert for the event
Block
Block the current request
and generate an alert
© 2017 Imperva, Inc. All rights reserved.9

10. © 2016 Imperva, Inc. All rights reserved.
Actions
Action Description Notes
Alert Generates a non-blocking alert for this event. Great for testing new rules
Block Request Blocks the current request and generates an alert. Preferred block action
Block Session
Blocks the current session and generates an alert. Any
subsequent request from the same session is blocked.
Session is based upon the Incap_session cookie –
NOT the application’s session (JSESSIONID, etc.)
Block IP
Blocks the current IP and generates an alert. Any
subsequent request from the same IP is blocked for a
period of 10 minutes.
Use with caution, clients originating from a VPN,
Proxy, or NAT may be inadvertently blocked
Require Cookie Support
Requires any client that matches the rule filters to support
cookies in order to complete the request.
May be of limited value when working with API’s.
Require JavaScript Support
Requires any client that matches the rule filters to support
JavaScript in order to complete the request.
Since the JavaScript test is embedded in an HTML
page, this action should only be enabled for HTML
resources.
Require CAPTCHA Support
Requires any client matching the rule filters to pass a
CAPTCHA test in order to complete the request.
Since the CAPTCHA test is embedded in an HTML
page, this action should only be enabled for HTML
resources.
© 2017 Imperva, Inc. All rights reserved.10

11. © 2016 Imperva, Inc. All rights reserved.
Filters
Anatomy of IncapRules
© 2017 Imperva, Inc. All rights reserved.11

12. © 2016 Imperva, Inc. All rights reserved.
Filters
Client Request Counters
Information about the
connecting client
Information about the
current HTTP Request
A running count of the
number of actions performed
• ASN
• Client IP
• Client ID
• Client Type
• Country Code
• User Agent
• ...
• Any Header Value
• Any Param Value
• Full URL
• Method
• Post Data
• Query String
• ...
• Attack
• Attacks Count
• GET Page IP Rate
• Num of User Agent
• Num on Session
• Post Rate
• ...
© 2017 Imperva, Inc. All rights reserved.12

13. © 2016 Imperva, Inc. All rights reserved.
Notable Client Filters
Client Type Client ID
© 2017 Imperva, Inc. All rights reserved.13

14. © 2016 Imperva, Inc. All rights reserved.
Notable Request Filters
Any Header/Param Value Header/Param Value
© 2017 Imperva, Inc. All rights reserved.14

15. © 2016 Imperva, Inc. All rights reserved.
Notable Counter Filters – Attacks Count
1. <IMG SRC="javascript:alert('XSS');">
2. <IMG SRC=javascript:alert('XSS')>
3. <IMG SRC=JaVaScRiPt:alert('XSS')>
4. <IMG SRC=javascript:alert("XSS")>
5. <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
6. ... <All Subsequent Requests Blocked>
© 2017 Imperva, Inc. All rights reserved.15

16. © 2016 Imperva, Inc. All rights reserved.
Common Rules
Putting it all Together
© 2017 Imperva, Inc. All rights reserved.16

17. © 2016 Imperva, Inc. All rights reserved.
Block Malicious Clients
Similar to “Block Bad
Bots” setting but
more aggressive
© 2017 Imperva, Inc. All rights reserved.17

18. © 2016 Imperva, Inc. All rights reserved.
CAPTCHA for High Rate of Access
Matches the index of
the current request in
the Incap session
Measures the rate of
requests per Incap
session over a one
minute timeframe
Excludes good bots
and browsers
Rule action set to
“Require CAPTCHA
Support”
© 2017 Imperva, Inc. All rights reserved.18

19. © 2016 Imperva, Inc. All rights reserved.
Block CSRF Attacks
Check to see if the
request has a
Session Cookie
Validate the
browser’s CORS
Origin Header
(HTTPS Only)
(Optional) Check the
Referer header
Potential Enhancements:
- Apply only to GET
requests
- Add a URL predicate to
apply it to the specific URL
that is vulnerable
© 2017 Imperva, Inc. All rights reserved.19

20. © 2016 Imperva, Inc. All rights reserved.
Questions?
© 2017 Imperva, Inc. All rights reserved.20