Applicable products
√ Cortex v2.x
√ Cortex 365 v2.x
Purpose
This solution lists the Custom Rules and Managed Rule Exclusions currently configured for the Eos Cortex application. Custom rules are laid out field-by-field where managed rule exclusions are laid out by Match variable, Operator, Selector, and what the exclusion applies to.
Prerequisites
- Administration and proper rights to create exception rules for your Web Application Firewall or other security appliance.
- An understanding of firewalls, exceptions, and network traffic routes.
Web Application Policy Settings
These policy settings are based on Azure Application Gateway WAF policy setting. Settings for your appliance may vary.
Body inspection & limits
- Enforce request body inspection: checked
- Maximum request body inspection limit (KB): 128
- Enforce custom maximum request body limit: checked
- Maximum request body size (KB): 192
- Enforce maximum file upload limit: checked
- Maximum file upload file size (MB): 100
Custom response
- Block response status code: %default 403%
- Block response body: %default value%
Rule action settings
- JavaScript Challenge expiration (mins): 30
Managed Rulesets
The policies are based on the following active managed rule set(s):
- Microsoft Bot Manager Rule Set 1.1
- OWASP 3.2
Managed Rule Exclusions
- Exclusion 1
Match variable: Request cookie name (RequestCookieNames)
Operator: Starts with
Selector: .AspNetCore.Identity.Application
Applies to: All managed rules (global exclusion - not limited to a specific rule set, group, or rule) - Exclusion 2
Match variable: Request cookie name (RequestCookieNames)
Operator: Starts with
Selector: .AspNetCore.Antiforgery
Applies to: All managed rules (global exclusion - not limited to a specific rule set, group, or rule) - Exclusion 3
Match variable: Request argument key (RequestArgKeys)
Operator: Starts with
Selector: fieldSort
Applies to: All managed rules (global exclusion - not limited to a specific rule set, group, or rule) - Exclusion 4
Match variable: Request cookie name (RequestCookieNames)
Operator: Starts with
Selector: .AspNet.Cookies
Applies to: All managed rules (global exclusion - not limited to a specific rule set, group, or rule) - Exclusion 5
Match variable: Request cookie name (RequestCookieNames)
Operator: Starts with
Selector: .AspNetCore.cortex.external
Applies to: All managed rules (global exclusion - not limited to a specific rule set, group, or rule) - Exclusion 6
Match variable: Request argument value (RequestArgValues)
Operator: Equals
Selector: redirect_uri
Applies to: Rule set = OWASP 3.2, Rule group = REQUEST-931-APPLICATION-ATTACK-RFI, Rule(s) = 931100, 931130 - Exclusion 7
Match variable: Request argument value (RequestArgValues)
Operator: Equals
Selector: redirect_uris
Applies to: Rule set = OWASP 3.2, Rule group = REQUEST-931-APPLICATION-ATTACK-RFI, Rule(s) = 931100, 931130 - Exclusion 8
Match variable: Request argument value (RequestArgValues)
Operator: Equals
Selector: client_uri
Applies to: Rule set = OWASP 3.2, Rule group = REQUEST-931-APPLICATION-ATTACK-RFI, Rule(s) = 931130 - Exclusion 9
Match variable: Request argument value (RequestArgValues)
Operator: Equals
Selector: returnUrl
Applies to: Rule set = OWASP 3.2, Rule group = REQUEST-920-PROTOCOL-ENFORCEMENT, Rule(s) = 920230
Applies to: Rule set = OWASP 3.2, Rule group = REQUEST-931-APPLICATION-ATTACK-RFI, Rule(s) = 931100, 931130
Custom Rules
- Rule: C2PublicFilesAllow
Custom rule name: C2PublicFilesAllow
Enable rule: Checked
Rule action: Allow traffic
Priority: 1
Rule Type: Match
Condition 1:
Match type: String
Match variable: Request URI
Operation: Is
Operator: Contains
Match values:
c2/
Transformation: Lowercase
Condition 2:
Match type: String
Match variable: Request URI
Operation: Is
Operator: Contains
Match values:
.js
.css
Transformation: Lowercase - Rule: C2OpenIdAllow
Custom rule name: C2OpenIdAllow
Enable rule: Checked
Rule action: Allow traffic
Priority: 2
Rule Type: Match
Condition 1:
Match type: String
Match variable: Request URI
Operation: Is
Operator: Contains
Match values:
.well-known/openid-configuration
signout-callback
signin-callback
signin-microsoft
signin-google
signin-oidc
.well-known/openai-apps-challenge
.well-known/oauth-protected-resource
.well-known/oauth-authorization-server
oauth/register
Transformation: Lowercase
Condition 2:
Match type: String
Match variable: RequestMethod
Operation: Is
Operator: Equal
Match values:
GET
HEAD
Transformation: Uppercase - Rule: C2PublicFoldersAllow
Custom rule name: C2PublicFoldersAllow
Enable rule: Checked
Rule action: Allow traffic
Priority: 3
Rule Type: Match
Condition 1:
Match type: String
Match variable: Request URI
Operation: Is
Operator: Contains
Match values:
c2/media
c2/assets
c2/help
c2/lib
Transformation: Lowercase - Rule: C2WebApiAllow1
Custom rule name: C2WebApiAllow1
Enable rule: Checked
Rule action: Allow traffic
Priority: 5
Rule Type: Match
Condition 1:
Match type: String
Match variable: Request URI
Operation: Is
Operator: Contains
Match values:
c2/api
c2/account
c2/licensekey
c2/ph/search/projects
ph/api/admin/users/save
ph/signin-oidc
ph/api/attachment
ph/api/attachment/createlink
ph/api/projectedit/elementoverride/importdatafromexcel
c2/oauth
Transformation: Lowercase - Rule: C2WebApiAllow2
Custom rule name: C2WebApiAllow2
Enable rule: Checked
Rule action: Allow traffic
Priority: 6
Rule Type: Match
Condition 1:
Match type: String
Match variable: Request URI
Operation: Is
Operator: Contains
Match values:
/oauth/register
Transformation: Lowercase - Rule: C2ServerWorkerAllow
Custom rule name: C2ServerWorkerAllow
Enable rule: Checked
Rule action: Allow traffic
Priority: 9
Rule Type: Match
Condition 1:
Match type: String
Match variable: Request URI
Operation: Is
Operator: Contains
Match values:
c2/ngsw
c2/chunk
Transformation: Lowercase - Rule: OauthLoginAllow
Custom rule name: OauthLoginAllow
Enable rule: Checked
Rule action: Allow traffic
Priority: 10
Rule Type: Match
Condition 1:
Match type: String
Match variable: Request URI
Operation: Is
Operator: BeginsWith
Match values:
/c2/Account/Login
Transformation: None - Rule: C2SignalRAllow
Custom rule name: C2SignalRAllow
Enable rule: Checked
Rule action: Allow traffic
Priority: 11
Rule Type: Match
Condition 1:
Match type: String
Match variable: Request URI
Operation: Is
Operator: Contains
Match values:
c2/systemhub
c2/budgetstaginghub
c2/testhub
Transformation: Lowercase - Rule: C2FaviconAllow
Custom rule name: C2FaviconAllow
Enable rule: Checked
Rule action: Allow traffic
Priority: 13
Rule Type: Match
Condition 1:
Match type: String
Match variable: Request URI
Operation: Is
Operator: Contains
Match values:
favicon.ico
Transformation: Lowercase - Rule: C2TokenAll
Custom rule name: C2TokenAll
Enable rule: Checked
Rule action: Allow traffic
Priority: 15
Rule Type: Match
Condition 1:
Match type: String
Match variable: Request URI
Operation: Is
Operator: Contains
Match values:
c2/
Transformation: None
Condition 2:
Match type: String
Match variable: Request header (Authorization)
Operation: Is
Operator: Contains
Match values:
bearer
Transformation: Lowercase - Rule: C2CookieAll
Custom rule name: C2CookieAll
Enable rule: Checked
Rule action: Allow traffic
Priority: 17
Rule Type: Match
Condition 1:
Match type: String
Match variable: Request URI
Operation: Is
Operator: Contains
Match values:
c2/
Transformation: Lowercase
Condition 2:
Match type: String
Match variable: Request header (Cookie)
Operation: Is
Operator: Contains
Match values:
.AspNetCore.Identity.Application
Transformation: Lowercase
Solution updated: 10/08/2026