DOCSEARCHbyAlgolia
Submit Docs

Waratek Documentation

website·Indexed 34 days ago

https://docs.waratek.com

Technical documentation for Waratek security products, including the RASP Java Agent (v25.0.0+), ARMR (v2.8 to v2.11), and the Dedicated Portal (v6.11.0 to v6.14.0). Covers installation, configuration, security rule management for CSRF and file system access, and troubleshooting for IBM J9 JDK VerifyError.

Tokens
462.7K
Snippets
1.7K
Records
3.3K
Agent score
50%

What's inside Waratek

  1. Overview of ARMR Sanitization rules

    The ARMR Sanitization rule verifies data (payloads) entering a server via HTTP requests. Payloads can be Strings, JSON, or XML. The rule matches payloads against known safe and unsafe patterns (e.g., Cross-Site-Scripting, SQL Injection, and Path Traversal).

    There are three possible outcomes for a payload:

    1. Safe: Allowed to proceed.
    2. Unsafe: Marked for sanitization; handled by the configured action (protect or detect).
    3. Undetermined: Payloads that don't cleanly match safe or unsafe patterns. These can be configured to be treated as either safe or unsafe.

  2. Overview of ARMR Deserialization Protection

    The ARMR deserialization security feature protects applications by placing deserialization operations in a restricted micro-segment (non-privileged context). This prevents attacks—including zero-day exploits—from accessing or changing the system state, executing privileged commands, or performing remote code injection.

    Key capabilities include:

    • RCE Protection: Blocks arbitrary privileged commands and remote code injection.
    • DoS Protection: Safeguards CPU and memory by setting default limits on the interaction frequency of deserialized objects to prevent resource exhaustion.
    • Supported Formats: Supports Java and XML deserialization. For XML, only java.beans.XMLDecoder is currently supported.
    • Unsupported Formats: JSON deserialization vulnerabilities are not currently supported.
    • CWE Coverage: Addresses CWE-502, CWE-250, CWE-799, and CWE-400.

  3. Overview of Team access control

    Teams are optional groups used to provide custom access control to Policies, Applications, Agents, and Events. Team Roles and permissions are secondary to a User's Organizational Role; they are only considered if the User lacks the required Organizational Role/permissions. When Teams are enabled, a Team selection option appears on forms for Policies and Applications.

  4. Overview of ARMR DSL for RASP Java Agent

    ARMR is an advanced Domain Specific Language (DSL) used by the Waratek RASP Java Agent to mitigate application vulnerabilities at runtime. While it allows for direct rule writing, most end-users can create or configure rules without manual ARMR syntax by using the Portal's Rules Wizard.

  5. Overview of ARMR Sanitization rules

    The ARMR Sanitization rule verifies data (payloads) entering a server via HTTP requests (Strings, JSON, or XML) against known safe and unsafe patterns. It protects against common attacks such as Cross-Site-Scripting (XSS), SQL Injection, and Path Traversal.

    There are two primary operation modes:

    • protect: Prevents the payload from being used by the system and generates a CEF event.
    • detect: Generates a CEF event but allows the workflow to continue uninterrupted.

  6. Overview of Portal Dedicated functionality

    Portal Dedicated (often abbreviated as Portal) is a management interface for the RASP Java Agent. It allows users to control the configuration of the RASP Java Agent and serves as a centralized location for receiving security events.

  7. Overview of ARMR Deserialization Protection

    The ARMR deserialization security feature protects applications from Java and XML deserialization attacks (including zero-day exploits) by running deserialization operations in a restricted, non-privileged compartment (micro-segment). This prevents attackers from executing privileged commands, performing remote code injection, or terminating the JVM.

    Key capabilities include:

    • RCE Protection: Blocks attempts to execute arbitrary privileged commands or change system internal state.
    • DoS Protection: Safeguards CPU and memory by setting default limits on interaction frequency for deserialized objects, mitigating brute force and resource exhaustion attacks.
    • Supported Formats: Java and XML (specifically java.beans.XMLDecoder).
    • Unsupported Formats: JSON deserialization vulnerabilities are not currently supported.
    • CWE Coverage: Addresses CWE-502, CWE-250, CWE-799, and CWE-400.

  8. Overview of Customer Vulnerability Reports

    The Customer Vulnerability Report tool allows users to upload a file containing a list of CVEs (from vulnerability scan data) and correlate them with Waratek patches currently active on a specific host. The tool parses the uploaded file for CVE numbers and compares them against the enabled patches in the policies associated with the host's agents to determine if a CVE is 'Patched' or 'Unpatched'.

  9. Overview of ARMR Sanitization rule

    The ARMR Sanitization rule verifies data (payloads) entering a server's workflow via HTTP requests, supporting String, JSON, and XML formats. It matches payloads against known safe and unsafe patterns (e.g., Cross-Site-Scripting, SQL Injection, and Path Traversal).

    Depending on the configured mode:

    • protect mode: Prevents the payload from being used by the system and generates a CEF event.
    • detect mode: Generates a CEF event but allows the workflow to continue uninterrupted.

  10. Overview of ARMR DSL for RASP Java Agent

    ARMR is an advanced Domain Specific Language (DSL) used by the RASP Java Agent to mitigate application vulnerabilities at runtime. While it allows for the direct writing of security rules, most end-users can achieve rule creation and configuration using the Portal's Rules Wizard without needing to write ARMR manually.

  11. Overview of ARMR DNS security rules

    The DNS security rule allows you to log and restrict DNS lookups performed by any application running on the Java Virtual Machine (JVM). This prevents abuse of the DNS service by limiting lookups to known and trusted domains.

    Key syntax rules:

    • Rules start with the dns keyword and end with enddns.
    • A rule name (arbitrary string in double-quotes) must be provided as a parameter to the dns keyword.
    • Duplicate statements within a single rule are not allowed, but multiple dns rules can exist within one ARMR application.
    • The order of statements inside a dns rule does not matter.

  12. Overview of ARMR Sanitization rule

    The ARMR Sanitization rule verifies data (payloads) entering a server's workflow via HTTP requests. Payloads can be Strings, JSON, or XML. The rule matches these payloads against known safe and unsafe patterns, specifically targeting common attacks such as Cross-Site-Scripting (XSS), SQL Injection, and Path Traversal. Payloads that match unsafe patterns are marked for sanitization and handled based on the configured rule action (Protect or Detect).