Managed Rules

The top of the Console → WAF → [your domain] → Rules page has three independent managed protection toggles. You didn’t write these — they come ready-made from HEIMWALL and are updated centrally. You just choose on or off.

Toggle	What it does	Default
HEIMWALL Rules	A ~110-rule set that recognises known attack techniques	On
Threat List	A block list of IP addresses known to be malicious	On
OWASP	An additional set that scans for common web-application attack patterns	Off

---

HEIMWALL Rules

Compares every incoming request against HEIMWALL’s database of known attack techniques. SQL injection attempts, path traversal, bot tool fingerprints, credential-stuffing patterns and ~110 other attack types are recognised and blocked here.

“Targets the technique” means: when a new vulnerability (CVE) is published, a different variant using the same technique may already be covered by these rules — no update needed on your side.

Updates are applied centrally by HEIMWALL and propagate to all servers within seconds.

Threat List

A continuously updated block list of IPs and IP ranges fed by cybersecurity threat intelligence sources. Botnet command-and-control servers, known attack infrastructure, Tor exit nodes and similar sources are tracked here.

When an IP on this list sends a request to your site, it is blocked before it even reaches the rule engine. You don’t manage this list — HEIMWALL does.

OWASP Signature Scanning

OWASP (Open Web Application Security Project) is an independent organisation that documents the most common security risks in web applications. Their “Top 10” list is a compilation of the 10 most frequently seen attack categories worldwide.

HEIMWALL carries the signatures of these categories built in:

Category	Real-world example
SQL Injection	Typing ' OR 1=1 -- in a login box to manipulate the database
XSS (Cross-site scripting)	Embedding a <script> tag in a form to affect other users
RCE (Remote code execution)	Payloads designed to run commands on the server
SSRF	Forcing the server to make requests to internal network addresses
Path traversal	Using ../../etc/passwd to access files outside the intended directory
Scanner tools	Fingerprints of automated security scanning tools like Nikto and sqlmap

Why is OWASP off by default?

OWASP signatures are broad and can trigger on some legitimate requests — especially in applications that accept forms, file uploads or free-form text. That’s why it’s off by default. Test it in a staging environment first and watch the logs before enabling it in production.

---

Enabling OWASP safely

1. Keep HEIMWALL Rules and Threat List on — they are on by default for new domains and are tuned for a low false-positive rate.

2. Before enabling OWASP, test it in a staging environment first if possible.

3. After enabling OWASP, monitor Console → WAF → [your domain] → Access logs for a few hours. Requests blocked by an OWASP signature appear in the logs.

4. If you spot a legitimate endpoint being blocked, write a bypass rule for that path — you don’t need to turn the whole set off.

---

Resolving false positives with bypass rules

Instead of disabling a managed layer for the whole site, you can disable it for a specific path:

Action	Layer it skips
bypassmanagedrule	HEIMWALL Rules
bypassdenylist	Threat List
bypassowasp	OWASP

Example — if a file-upload endpoint trips OWASP signatures:

IF   http.request.base_uri has_prefix /api/upload
THEN bypassowasp

With these selections in the console: Field Path (without query) · Operator starts with · Value /api/upload → Action Bypass OWASP

Bypass actions apply only to matching requests; the rest of the site stays protected.

Package scope

Managed rules are a package-gated feature. If the toggles appear locked, your package does not include this feature — contact support to upgrade.