WAF Update Notifications

[rammstein]

Username: rammstein

TITLE

WAF Update Notifications

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Plesk Obsidian
Version 18.0.32 Update Nr. 2
Atomic Advanced (purchased through Plesk)
Ubuntu 16.04.7

PROBLEM DESCRIPTION

Notifications are no longer displayed every day.
Like: "Web application firewall: new rule or new rule set was installed"

The "advanced rule set" apparently receives daily updates, the rules in /etc/apache2/modsecurity.d/rules/tortix/modsec/ have a new time stamp every day.

STEPS TO REPRODUCE

• Install Plesk
• Install Advanced ModSecurity Rules by Atomicorp

ACTUAL RESULT

WAF works, but Notifications are not working as expected

EXPECTED RESULT

Receive Notification on every update

ANY ADDITIONAL INFORMATION

Is this a bug or did I only notice it now?
Not sure, but I think it wasn't like that a while ago.

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Confirm bug

 

[Bitpalast]

The notifications can be set in the upper right corner of the notifications pop-up screen. Click on the gear icon, then select which notifications shall be displayed.



Also, the rules are not updated daily. It is very well possible that there are no notifications for a few days.

 

[rammstein]

The rules are not updated daily?

Atomic ModSecurity Rule Sets

The Atomic Basic ModSecurity rule set includes the following: SQL injection protection. Cross-site scripting protect...

docs.plesk.com

The last paragraph says: "Updates multiple times daily."

I see notifications about the "rule updates", but not every day.

 

[Bitpalast]

If you have the paid "complete Advanced ModSecurity Rules by Atomicorp rule set", the it is updated multiple times daily. But if you are using the free version, this is not the case. Sorry, I assumed that you are using the free ruleset, because most users do.

 

[rammstein]

No problem, I have the paid version (Atomic Advanced (purchased through Plesk))

With the update notifications it looks like this:
Jan. 9
Jan. 12
Jan. 13
Jan. 18
Jan. 19
Jan. 21

Don't know if that should be the case ..?

On the other hand, "multiple times daily", it would probably also not make sense to create a notification about every update.

 

[Bitpalast]

Atomic are advertising "daily" updates instead of "multiple times daily", but frankly honest, can we be sure that rules need to be updated daily? The advanced rule set includes 4,500 rules. Do we really see so many new ways to attack a website that these need to be updated daily? Maybe it means "we're looking into it daily, and if something needs to be changed, we'll update it, else things will stay as they are". It would be interesting to know what others are seeing who are using the advanced rule set and what these daily updates are.