Submenu – Policy Learning

For initial learning, we suggest the following procedure:

1. Put all relevant Mappings in "log only" mode.
2. Let trusted users interact with the application. This allows Airlock Gateway to learn legitimate traffic patterns not influenced by potentially malicious users.
3. Consult the Policy Learning dashboard and accept appropriate suggestions.
4. Enforce the policy by setting threat handling to "block request" or "terminate session".

For enabling allow list learning (learning of Allow Rules) please refer to section allow list Learning below.

Once a security policy is enforced, the policy learning dashboard keeps showing violating/blocked requests. The same machanisms for accepting suggestions can be used to fine-tune the policy in place. There is no need to enable the learning mode explicitly.

Various filter criteria such as a time interval, IP addresses, paths, or request IDs can be used to customize the set of currently displayed blocks. Use "%" as a wildcard in filter criteria.

The following options allow further restriction of the displayed blocks:

For blocks selected by the current filter, various attributes are shown in the result table, e.g., the corresponding Virtual Host or Mapping. Simply click on the arrows in the table header to sort the table according to a specific attribute. To show or hide columns click on the button on the right side above the table.

By clicking on a specific block in the result list, the block is selected and can be further investigated using the tab 'Request Details' below the results table. The 'Request Details' show all details of a blocked request and the circumstances leading to the blocking decision, e.g., the name of the matching Deny Rule or the values of offending parameter and header values. These details help the administrator to decide which suggestion to accept and whether a certain block is a false positive or not.

Parameters and header values may be trimmed before they are stored in the block list.

For each blocked request, Airlock Gateway automatically generates suggestions that prevent similar blocks in the future. These suggestions consist of modifications applied to the current configuration. Typically, Airlock Gateway generates multiple suggestions with different specificity. To show all suggestions for a block, select the block and open the 'Policy Suggestions' tab below the result table. Of all the generated suggestions, Airlock Gateway selects one as the favorite suggestion.

The favorite suggestion aims to strike a balance between two scenarios:

• Adding a very specific configuration change.
  This comes with a small negative security impact but with the drawback that similar requests may cause other false positive blocks. Further the configuration may get fragmented if many of these specific changes need to be applied.
• Adding a very generic configuration change.
  This has a larger negative security impact by allowing more requests to pass than may be necessary. However, as it typically covers more variants of the same block type, there is usually no need to add further changes which may reduce the integration effort.

For example, if parameter 'comment' was blocked by an SQL injection Deny Rule on path '/application', several suggestions are proposed:

To assist the administrator in accepting the appropriate suggestion, the number of blocks covered is indicated in the 'Blocks Covered' column. For instance, if a very generic suggestion covers only few blocks, more specific suggestion should be accepted instead. However, if a generic suggestion covers many blocks that would otherwise require a lot of specific suggestions, it may be better accepting the generic suggestion.

For each block, the favorite suggestion is presented in the result table as a shortcut and can be accepted by clicking the 'Accept' icon on the right side.

On top of the 'Accept' icon column, an 'Accept all' icon is located. By clicking 'Accept all', all currently displayed favorite suggestions are automatically accepted. The currently displayed favorite suggestions are those visible in the result table as defined by the filter criteria and the chosen result size (10, 25, or 50).

Accepting all favorite suggestions at once is a powerful option when filtered blocks originate form traffic that is generally trusted, e.g., because it originates from a set of internal test clients. However, we do not recommend using this feature without carefully reviewing all suggestions.

For accepting alternative suggestions, open the tab 'Policy Suggestions' and accept any of the listed suggestions.

All handled blocks are deleted when the configuration is activated. To delete handled block manually, select the option 'Handled blocks' and click on the 'Clear blocks' button on the bottom of the page. This option can be useful when the configuration is exported or saved without activation. By importing the configuration at a later point in time, handled blocks are no longer shown, which prevents adding obsolete configuration settings by accepting suggestions for already handled blocks.