Skip to main content

WAF Curator

Web application protection against targeted attacks in partnership with Curator.

The main purpose of Curator WAF is to block attacks and eliminate vulnerabilities included in the common web application vulnerabilities list by the Open Web Application Security Project.

The service is available only as an add-on to the Curator Protection service.

How it works

After connecting the service, application traffic that already passes through the main Curator protection is additionally routed to the Curator WAF protection system.

For the first two weeks after activating the service, the system operates in monitoring and learning mode to learn how to protect your specific application. To do this, the system studies user behavior and checks traffic for compliance with known types of attacks.

During the learning phase, Curator specialists independently monitor anomalies and suppress false positives—requests from real users that the system mistakenly identified as an attack.

Based on the collected data, filtering rules are generated and the accuracy of attack blocking is improved.

Once system training is complete, Curator specialists will notify you in a ticket in the Curator control panel and you will be able to enable protection.

Pricing

A one-time payment equal to the cost of the selected plan is charged on the day of activation. Subsequently, the payment is charged automatically on the first day of each month. The monthly payment includes:

  • monthly fee — a fixed payment for the next month;
  • connecting an additional domain.

The plan includes 3 Mbps bandwidth. If this limit is exceeded, each additional Mbps is charged separately. An invoice for additional bandwidth is generated in the Control panel within five business days after the end of the calendar month.

Curator WAF subscription fees, additional Mbps, and extra domain connection prices can be found on selectel.ru.

Bandwidth calculation

Only legitimate traffic—traffic cleared of malicious requests—is billed. Attack traffic is not counted.

To calculate bandwidth, the volume of outgoing traffic and incoming traffic cleared by the filtering system is measured every minute. The maximum value from these measurements is selected for each minute. At the end of the calendar month, all values are sorted in descending order. 90 maximum values are excluded from the calculation. The remaining value is rounded down to the nearest whole Mbps—this number is the bandwidth value. If it exceeds 3 Mbps, each additional Mbps is billed separately.

Enable service⁠​

  1. In the Control panel, in the top menu, click Products and select DDoS protection.
  2. Go to the DDoS protection section.
  3. Click Order services.
  4. In the row of the required plan (Curator — Elementary WAF, Curator — Advisory WAF), click Pay.
  5. Check the details and click Pay for service.
  6. We will create a ticket for connecting the service, where we will specify a connection date convenient for you.

Working in the Curator control panel

Login credentials for the Curator account will be sent to the email address specified when ordering the Curator Protection service.

In the Curator control panel, you can:

Enable protection

Once system training is complete, Curator specialists will notify you in your account. After that, you can enable attack blocking mode; to do this, in the WAF section, select the Active protection checkbox.

If your application is under attack but system learning is not yet complete, contact Curator technical support to discuss enabling attack blocking mode on an individual basis.

Suppress a false positive

During the system learning phase, Curator specialists suppress false positives so that their number is minimal when protection is operational.

After system training, you can track false positives on your own using statistics tools.

If you notice a false positive, contact Curator technical support in your account and specify the transaction number with the false positive. You can find the transaction number in the transaction list in the WAF section. Curator specialists will analyze the anomaly and adjust the model. Filtering rules will be reconfigured automatically, and the system will allow similar requests. You can also suppress false positives on your own.

View statistics⁠​

Statistics are available in the WAF section. Here you can view:

  • a dashboard with key traffic metrics;
  • security events grouped by type and threat level;
  • a list of transactions — requests, responses, and errors.

Disable service⁠​

To disable Curator WAF, create a ticket.

The service is disabled on the last day of the calendar month. If you need to disable the service earlier, the payment for the current month is not refunded.

If bandwidth exceeded 3 Mbps during the last month of service, in the Control panel an invoice for additional bandwidth will be generated within five business days after the end of the calendar month.

Disabling Curator WAF does not affect the main Curator protection — it will continue to work.