In the context of a firewall or Web Application Firewall (WAF), the terms rule group, rule group level, and CC level refer to different layers or components involved in detecting and blocking malicious traffic. Here's a breakdown:
---
1. Rule Group
A rule group is a collection of rules designed to detect and mitigate specific types of threats. These rules are typically grouped by function or attack type.
Example in WAF: A rule group might contain rules for detecting SQL injection, XSS, or file inclusion attacks.
Example in Firewall: A rule group could handle traffic filtering based on IP addresses, ports, protocols, or applications.
Managed Rule Groups: In services like AWS WAF or Cloudflare, rule groups can be managed by third parties, constantly updated to address new threats.
---
2. Rule Group Level
The rule group level refers to the order or priority in which rule groups are applied. This is important for layered security and performance.
Think of it as a hierarchy or stack:
Level 1: Global filters like IP reputation or geoblocking.
Level 2: Application-layer protection like SQLi, XSS.
Level 3: Custom business logic or allow-lists.
Higher-level rule groups may block or allow traffic before it even reaches the next level.
Some WAFs let you assign action priorities, such as ALLOW, BLOCK, COUNT, or LOG.
---
3. CC Level (Challenge Collapsar Level)
CC Level (also known as Challenge Collapsar level) is primarily a DDoS protection parameter, often used in Chinese WAFs/firewalls (like Baidu, Tencent Cloud, or CDN-level WAFs).
CC attacks = “Challenge Collapsar” attacks, a type of HTTP flood DDoS.
CC Level is a sensitivity setting that controls how aggressively the WAF/firewall blocks suspected CC attacks.
Too high a CC Level may cause false positives, blocking legitimate users.
---
Summary Table
Let me know if you'd like this mapped to a specific product like AWS WAF, Cloudflare, or Fortinet.
Comments
Post a Comment