Version Control

Purpose

Version Control provides you with a tabular overview of all rulesets that have ever been committed and activated on your system. You can track which administrator made which setting, and use Version Control to meet any legal or contractual regulations for record-keeping. You can also print out the documentation on paper.

All previous versions of a ruleset can be edited and activated again at any time.

Every application has a separate ruleset and therefore has separate Version Control. The number of versions available at any time may vary from application to application. Versions with different version numbers can also be active from application to application.

Opening

In the navigation area, select the application for which you want to open Version Control.
Activate the Configuration | Version Control tab.

Status section

The Status section lets you choose which rulesets are loaded and active:

Protection Ruleset
This ruleset can only be chosen when protection mode is enabled for the application (see Detection Mode, Protection Mode). It determines which requests vWAF actually denies.
Detection Ruleset
Ruleset for monitoring and testing purposes. If a handler of this ruleset becomes active, vWAF only writes an entry to the log files but doesn’t block any traffic.
Loaded Ruleset
The ruleset that’s currently loaded into the administration interface for editing.

History section

The History section lists all versions that have ever been committed.

The check box on top of the list determines whether all rulesets are shown or whether only those rulesets are shown that aren’t hidden.

Column	Meaning
Version	Current version number.
Status	Shows which of the versions displayed is currently loaded for editing (Loaded) and which is currently active in the decider (Active).
Time	Date (YYYY-MM-DD) and time when that version was committed.
User	Username of the administrator by whom that version was committed.
Comment	Comment entered by the administrator on commit in the field Commit Comment (see Committing and Activating Ruleset Changes).
Action	Clicking View displays a printable summary of a specific version. Clicking Changes lists all modifications that were made between two versions. Clicking Hide removes the ruleset from the list of shown rulesets. Clicking Unhide makes a hidden ruleset visible again (only available if hidden rulesets are shown).

Changing the protection ruleset

This can only be done when protection mode is enabled for the application (see Detection Mode, Protection Mode).

To change the protection ruleset:

From the drop-down list after Protection Ruleset choose the number of the ruleset that you want to activate. For details on the different versions, refer to the table in the History section.
Click the Activate button.
The chosen ruleset becomes active immediately.

Note that the ruleset that you’re currently editing (the loaded ruleset) doesn’t change in this process. If you activate a ruleset that was set to be detection ruleset before, detection automatically gets disabled.

Enabling / disabling a detection ruleset

To enable a detection ruleset, which only creates log file entries but doesn’t block any traffic:

From the drop-down list after Detection Ruleset choose the number of the ruleset that you want to activate as a detection ruleset. For details on the different versions, refer to the table in the History section.
Note that you can’t choose the current protection ruleset here. If you want to use this ruleset for detection, you must first change the protection ruleset.
Click the Set button. The chosen ruleset becomes active immediately.

To disable the detection ruleset, select the option disabled from the drop-down list and proceed as described above.

You can only disable a detection ruleset when protection mode is enabled for the application (see Detection Mode, Protection Mode).

Loading a different version for editing

ATTENTION
If you’ve made changes to the ruleset that’s currently loaded since the last time the changes were committed, these changes are lost when an older version is loaded. If you want to call up your current changes again, you need to commit them beforehand (see Committing and Activating Ruleset Changes).

To reload an earlier version for editing:

From the drop-down list after Loaded Ruleset choose the number of the ruleset that you want to load. For details on the different versions, refer to the table in the History section.
Click the Load button.

The chosen ruleset is now loaded into the administration interface and you can edit it.

Note that the rulesets used by the decider (the protection ruleset and the detection ruleset) don’t change in this process.

Viewing an old version and printing documentation

You can view a complete overview of the settings for a specific version and print it out. To do this, click in the Action column on the link View.

The Printable Application Configuration opens with a list of all attributes for the ruleset in question. To print the list, click the Print button below the list.

Hiding unneeded rulesets for more clarity

Over time, your number of stored rulesets grows. When the History list or the drop-down lists grow too long and get cluttered, you can remove rulesets that you don’t need from these lists.

Hiding a ruleset doesn’t delete the ruleset. A hidden ruleset just doesn’t appear on the lists any longer. You can unhide a hidden ruleset at any time. Also, you can still assign a hidden ruleset via the REST interface.

Note that hiding a ruleset is a global setting. If you hide a ruleset, other administrators also won’t see it.

To hide a ruleset:

In the History list, go to the Action column, and then click Hide. Note that you can only hide rulesets that aren’t currently chosen as Protection Ruleset, Detection Ruleset, or Loaded Ruleset.
Make sure that above the list, the option Show all rulesets is disabled.

Unhiding a ruleset

To unhide a hidden ruleset:

In the History section, above the list, activate the option Show all rulesets. The list now also shows the hidden rulesets.
Go to the line of the ruleset that you want to unhide. In the Action column, click Unhide.
You can now deactivate the option Show all rulesets again. The ruleset remains visible in the list.