Getting Started with Declarative Policies

BIG-IP devices running version 15.1.x or later
BIG-IP Administrator role permissions
An active ASM or Advanced WAF license on the BIG-IP devices

Core

Defined within the root

policy

property, the core section includes the name, description, and template for the policy.

The template field is mandatory, and referenced by name. Templates are prepared policies designed for a category of applications. The template name implies the level of security and the attack surface it protects.

The template file must be stored on the BIG-IP device in which the policy is created. F5 provides a set of predefined templates, which users can modify and save to create their own templates. For more information about these templates, refer to Predefined templates.

The following is an example of the core section within the declarative policy:

"name": "AppPolicy01",
"description": "AppV1.1 - DEMO FOR DECLARATIVE AND WEBHOOKS CAPABILITIES",
"template": { "name": "POLICY_TEMPLATE_FUNDAMENTAL" },

Adjustments

Defined within the root

policy

property after the core section, the adjustments section includes attributes of the policy that override or add to those defined in the template .

Attributes included in this section can include both properties that are particular to the protected application, such as server technologies, URLs, or parameters, and modifications to settings defined by the template, such as enabling the Data Guard if it is disabled in the template, and specifying Data Guard attributes.

The adjustments section contains all the entities of the security policy. All adjustments are optional. If there are no adjustments, the values are taken from the defined template.

The following is an example of the adjustments section within the declarative policy:

"enforcementMode": "blocking",
"server-technologies": [
    {
        "serverTechnologyName": "MySQL"
    }
],
"signature-settings": {
    "signatureStaging": false
},

Modifications

Defined within the

modifications

property, after the core and adjustments sections, the modifications section includes actions that modify the declarative policy as it is defined in the adjustments section. The modifications section is updated manually, with the changes generally driven by the learning suggestions provided by the BIG-IP.

Changes to the template can be defined in either the adjustments or modifications sections. In general, the adjustments section is used for defining major features of the policy which are different from template, while the modifications section is used for frequent and granular changes that are required to tune the policy, such as reducing false positives, patching vulnerabilities, etc.

When an attribute is defined in both the adjustments and modifications sections, the policy is deployed with the value as it appears in the modifications section. When an attribute appears in the modifications section multiple times, the policy is deployed with the value as it appears in the latest definition in the modifications section.

The following is an example of the modifications section within the declarative policy:

"modifications": [
    {
        "entityChanges": {
            "type": "explicit"
        },
        "entity": {
            "name": "log"
        },
        "entityType": "filetypes",
        "action": "delete",
        "description": "Delete Disallowed File Type"
    }
]

{
    "policy": {
        "name": "PolicyApp01",
        "description": "PolicyApp01 Description Example",
        "template": {
            "name": "POLICY_TEMPLATE_RAPID_DEPLOYMENT"
        },
        "enforcementMode": "blocking",
        "server-technologies": [
            {
                "serverTechnologyName": "MySQL"
            }
        ],
        "signature-settings": {
            "signatureStaging": false
        },
        "signatures": [
            {
                "signatureId": 200101552,
                "enabled": false,
                "performStaging": false
            }
        ],
        "whitelist-ips": [
            {
                "ipAddress": "10.0.0.1",
                "ipMask": "255.255.255.255",
                "description": "always block this ip address",
                "blockRequests": "always"
            }
        ],
        "disallowed-geolocations": [
            {
                "countryName": "American Samoa"
            }
        ]
    },
    "modifications": []
}