Defending Streamline Media's public web apps with a WAF: requests from the internet pass eight standing layers — deployment, signatures, rules, rate limiting, bot defense, tuning, monitoring and response — before reaching the storefront origin. A SQL injection payload is stopped by the OWASP Core Rule Set, a public 0-day proof of concept by a virtual patch, 4,000 login attempts a minute by rate limiting and a slow scraper by bot challenges, while a real checkout passes through. Below, tuning replaces a blocked apostrophe with a one-field exclusion, monitoring moves from logs deleted after three days to a central dashboard, and response ships a virtual patch the same morning a 0-day is disclosed.

CY-MID-056Mid Level · WAF Operations

Web Application Firewall Operations — The WAF Defense Stack

A hands-on mid-level course that runs a WAF that blocks attacks without blocking customers. Work the WAF defense stack - eight layers: Deployment, Signatures, Rules, Rate Limiting, Bot Defense, Tuning, Monitoring, and Response - deploying managed and custom rules, cutting false positives, and stopping OWASP-class attacks and bots. Strictly defensive. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Deploy a WAF in the right mode and topology for your apps.
Tune managed and custom rules to block attacks with few false positives.
Add rate limiting and bot defense without hurting real users.
Monitor, alert, and respond to what the WAF sees.

Price:৳8,000