Support

Applicable products

√ Cortex v2.x

√ Cortex 365 v2.x

Purpose

This solution lists the Custom Rules and Managed Rule Exclusions currently configured for the Eos Cortex application. Custom rules are laid out field-by-field where managed rule exclusions are laid out by Match variable, Operator, Selector, and what the exclusion applies to. 

Prerequisites

• Administration and proper rights to create exception rules for your Web Application Firewall or other security appliance.
• An understanding of firewalls, exceptions, and network traffic routes. 

Custom Rules

1. Rule: C2PublicFilesAllow
   
   Custom rule name: C2PublicFilesAllow
   Enable rule: Checked
   Rule action: Allow traffic
   Priority: 1
   Rule Type: Match
   
   Condition 1:
   Match type: String
   Match variable: Request URI
   Operation: Is
   Operator: Contains
   Match values:
   c2/
   Transformation: Lowercase
   
   Condition 2:
   Match type: String
   Match variable: Request URI
   Operation: Is
   Operator: Contains
   Match values:
   .js
   .css
   Transformation: Lowercase
   
   
   
2. Rule: C2OpenIdAllow
   
   Custom rule name: C2OpenIdAllow
   Enable rule: Checked
   Rule action: Allow traffic
   Priority: 2
   Rule Type: Match
   
   Condition 1:
   Match type: String
   Match variable: Request URI
   Operation: Is
   Operator: Contains
   Match values:
   .well-known/openid-configuration
   signout-callback
   signin-callback
   signin-microsoft
   signin-google
   signin-oidc
   .well-known/openai-apps-challenge
   .well-known/oauth-protected-resource
   .well-known/oauth-authorization-server
   oauth/register
   Transformation: Lowercase
   
   Condition 2:
   Match type: String
   Match variable: RequestMethod
   Operation: Is
   Operator: Equal
   Match values:
   GET
   HEAD
   Transformation: Uppercase
   
   
3. Rule: C2PublicFoldersAllow
   
   Custom rule name: C2PublicFoldersAllow
   Enable rule: Checked
   Rule action: Allow traffic
   Priority: 3
   Rule Type: Match
   
   Condition 1:
   Match type: String
   Match variable: Request URI
   Operation: Is
   Operator: Contains
   Match values:
   c2/media
   c2/assets
   c2/help
   c2/lib
   Transformation: Lowercase
   
   
4. Rule: C2WebApiAllow1
   
   Custom rule name: C2WebApiAllow1
   Enable rule: Checked
   Rule action: Allow traffic
   Priority: 5
   Rule Type: Match
   
   Condition 1:
   Match type: String
   Match variable: Request URI
   Operation: Is
   Operator: Contains
   Match values:
   c2/api
   c2/account
   c2/licensekey
   c2/ph/search/projects
   ph/api/admin/users/save
   ph/signin-oidc
   ph/api/attachment
   ph/api/attachment/createlink
   ph/api/projectedit/elementoverride/importdatafromexcel
   c2/oauth
   Transformation: Lowercase
   
   
5. Rule: C2WebApiAllow2
   
   Custom rule name: C2WebApiAllow2
   Enable rule: Checked
   Rule action: Allow traffic
   Priority: 6
   Rule Type: Match
   
   Condition 1:
   Match type: String
   Match variable: Request URI
   Operation: Is
   Operator: Contains
   Match values:
   /oauth/register
   Transformation: Lowercase
   
   
6. Rule: C2ServerWorkerAllow
   
   Custom rule name: C2ServerWorkerAllow
   Enable rule: Checked
   Rule action: Allow traffic
   Priority: 9
   Rule Type: Match
   
   Condition 1:
   Match type: String
   Match variable: Request URI
   Operation: Is
   Operator: Contains
   Match values:
   c2/ngsw
   c2/chunk
   Transformation: Lowercase
   
   
7. Rule: OauthLoginAllow
   
   Custom rule name: OauthLoginAllow
   Enable rule: Checked
   Rule action: Allow traffic
   Priority: 10
   Rule Type: Match
   
   Condition 1:
   Match type: String
   Match variable: Request URI
   Operation: Is
   Operator: BeginsWith
   Match values:
   /c2/Account/Login
   Transformation: None
   
   
8. Rule: C2SignalRAllow
   
   Custom rule name: C2SignalRAllow
   Enable rule: Checked
   Rule action: Allow traffic
   Priority: 11
   Rule Type: Match
   
   Condition 1:
   Match type: String
   Match variable: Request URI
   Operation: Is
   Operator: Contains
   Match values:
   c2/systemhub
   c2/budgetstaginghub
   c2/testhub
   Transformation: Lowercase
   
   
9. Rule: C2FaviconAllow
   
   Custom rule name: C2FaviconAllow
   Enable rule: Checked
   Rule action: Allow traffic
   Priority: 13
   Rule Type: Match
   
   Condition 1:
   Match type: String
   Match variable: Request URI
   Operation: Is
   Operator: Contains
   Match values:
   favicon.ico
   Transformation: Lowercase
   
   
10. Rule: C2TokenAll
    
    Custom rule name: C2TokenAll
    Enable rule: Checked
    Rule action: Allow traffic
    Priority: 15
    Rule Type: Match
    
    Condition 1:
    Match type: String
    Match variable: Request URI
    Operation: Is
    Operator: Contains
    Match values:
    c2/
    Transformation: None
    
    Condition 2:
    Match type: String
    Match variable: Request header (Authorization)
    Operation: Is
    Operator: Contains
    Match values:
    bearer
    Transformation: Lowercase
    
    
11. Rule: C2CookieAll
    
    Custom rule name: C2CookieAll
    Enable rule: Checked
    Rule action: Allow traffic
    Priority: 17
    Rule Type: Match
    
    Condition 1:
    Match type: String
    Match variable: Request URI
    Operation: Is
    Operator: Contains
    Match values:
    c2/
    Transformation: Lowercase
    
    Condition 2:
    Match type: String
    Match variable: Request header (Cookie)
    Operation: Is
    Operator: Contains
    Match values:
    .AspNetCore.Identity.Application
    Transformation: Lowercase
    
    

Managed Rule Exclusions

Active managed rule set(s): OWASP 3.2, Microsoft_BotManagerRuleSet 1.1

1. Exclusion 1
   Match variable: Request cookie name (RequestCookieNames)
   Operator: Starts with
   Selector: .AspNetCore.Identity.Application
   Applies to: All managed rules (global exclusion - not limited to a specific rule set, group, or rule)
   
   
2. Exclusion 2
   Match variable: Request cookie name (RequestCookieNames)
   Operator: Starts with
   Selector: .AspNetCore.Antiforgery
   Applies to: All managed rules (global exclusion - not limited to a specific rule set, group, or rule)
   
   
3. Exclusion 3
   Match variable: Request argument key (RequestArgKeys)
   Operator: Starts with
   Selector: fieldSort
   Applies to: All managed rules (global exclusion - not limited to a specific rule set, group, or rule)
   
   
4. Exclusion 4
   Match variable: Request cookie name (RequestCookieNames)
   Operator: Starts with
   Selector: .AspNet.Cookies
   Applies to: All managed rules (global exclusion - not limited to a specific rule set, group, or rule)
   
   
5. Exclusion 5
   Match variable: Request cookie name (RequestCookieNames)
   Operator: Starts with
   Selector: .AspNetCore.cortex.external
   Applies to: All managed rules (global exclusion - not limited to a specific rule set, group, or rule)
   
   
6. Exclusion 6
   Match variable: Request argument value (RequestArgValues)
   Operator: Equals
   Selector: redirect_uri
   Applies to: Rule set = OWASP 3.2, Rule group = REQUEST-931-APPLICATION-ATTACK-RFI, Rule(s) = 931100, 931130
   
   
7. Exclusion 7
   Match variable: Request argument value (RequestArgValues)
   Operator: Equals
   Selector: redirect_uris
   Applies to: Rule set = OWASP 3.2, Rule group = REQUEST-931-APPLICATION-ATTACK-RFI, Rule(s) = 931100, 931130
   
   
8. Exclusion 8
   Match variable: Request argument value (RequestArgValues)
   Operator: Equals
   Selector: client_uri
   Applies to: Rule set = OWASP 3.2, Rule group = REQUEST-931-APPLICATION-ATTACK-RFI, Rule(s) = 931130
   
   
9. Exclusion 9
   Match variable: Request argument value (RequestArgValues)
   Operator: Equals
   Selector: returnUrl
   Applies to: Rule set = OWASP 3.2, Rule group = REQUEST-920-PROTOCOL-ENFORCEMENT, Rule(s) = 920230
   Applies to: Rule set = OWASP 3.2, Rule group = REQUEST-931-APPLICATION-ATTACK-RFI, Rule(s) = 931100, 931130