fastly-ngwaf

Name: fastly-ngwaf
Author: fastly

28stars5forks

How to install fastly-ngwaf?

fastly/fastly-agent-toolkit/fastly-ngwaf

$npx -y skills add fastly/fastly-agent-toolkit --skill fastly-ngwaf

Installs into the current project.

Summary

Performs an internal audit of Fastly Next-Gen WAF (NGWAF) workspaces to audit that critical templated protection rules are configured and enabled. Use when auditing NGWAF workspace security posture, checking for missing or disabled login protection rules (LOGINDISCOVERY, LOGINATT

Files · 1

View on GitHub

SKILL.md

1	# Fastly NGWAF Workspace Audit
2
3	Audits NGWAF workspaces to verify critical templated rules are configured and enabled. Use the fastly-cli skill to configure rules; this skill identifies gaps.
4
5	## Quick Start
6
7	Run the bundled assessment script (requires `jq` and `FASTLY_API_KEY`):
8
9	```bash
10	./scripts/assess_ngwaf_rules.sh
11	```
12
13	For manual inspection or partial audits, use the API calls below.
14
15	## Audit Workflow
16
17	1. List workspaces — verify the account has NGWAF workspaces
18	2. Fetch rules per workspace — retrieve each workspace's rule set
19	3. Validate critical signals — confirm required rules exist and are enabled
20	4. Flag gaps and search for uncovered endpoints — report missing/disabled rules
21
22	### Step 1: List Workspaces
23
24	```bash
25	curl -s -H "Fastly-Key: $FASTLY_API_KEY" \
26	"https://api.fastly.com/ngwaf/v1/workspaces?limit=200" \| jq '.data[].id'
27	```
28
29	If empty, NGWAF is not configured for this account.
30
31	### Step 2: Fetch Rules for a Workspace
32
33	```bash
34	curl -s -H "Fastly-Key: $FASTLY_API_KEY" \
35	"https://api.fastly.com/ngwaf/v1/workspaces/$WORKSPACE_ID/rules?limit=200"
36	```
37
38	### Step 3: Validate Critical Signals
39
40	For each workspace, verify these templated rules exist and `enabled` is `true`:
41
42	\| Category \| Required Signals \|
43	\| ---------------------- \| ---------------------------------------------------------------- \|
44	\| Login Protection \| `LOGINDISCOVERY`, `LOGINATTEMPT`, `LOGINSUCCESS`, `LOGINFAILURE` \|
45	\| Credit Card Validation \| `CC-VAL-ATTEMPT`, `CC-VAL-FAILURE`, `CC-VAL-SUCCESS` \|
46	\| Gift Card Validation \| `GC-VAL-ATTEMPT`, `GC-VAL-FAILURE`, `GC-VAL-SUCCESS` \|
47
48	Check a specific signal:
49
50	```bash
51	curl -s -H "Fastly-Key: $FASTLY_API_KEY" \
52	"https://api.fastly.com/ngwaf/v1/workspaces/$WORKSPACE_ID/rules?limit=200" \
53	\| jq '[.data[] \| select(.actions[].signal == "LOGINDISCOVERY") \| {enabled, id}]'
54	```
55
56	### Step 4: Search for Uncovered Login Endpoints
57
58	When `LOGINATTEMPT` is missing or disabled, search recent request logs for login-like traffic the WAF isn't protecting:
59
60	```bash
61	curl -s -H "Fastly-Key: $FASTLY_API_KEY" \
62	"https://api.fastly.com/ngwaf/v1/workspaces/$WORKSPACE_ID/requests?limit=100&page=1&q=from%3A-30min%20method%3APOST%20path%3A~%22%2Alogin%2A%22" \
63	\| jq -r '.data[].path' \| sort \| uniq -c
64	```
65
66	## Expected Output
67
68	Healthy workspace — all signals present and enabled:
69
70	```text
71	### Workspace: abc123
72	[LOGIN Rules]
73	- LOGINDISCOVERY: ENABLED
74	- LOGINATTEMPT: ENABLED
75	- LOGINSUCCESS: ENABLED
76	- LOGINFAILURE: ENABLED
77	[CC Rules]
78	- CC-VAL-ATTEMPT: ENABLED
79	- CC-VAL-FAILURE: ENABLED
80	- CC-VAL-SUCCESS: ENABLED
81	[GC Rules]
82	- GC-VAL-ATTEMPT: ENABLED
83	- GC-VAL-FAILURE: ENABLED
84	- GC-VAL-SUCCESS: ENABLED
85	```
86
87	Unhealthy workspace — missing or disabled rules require remediation:
88
89	```text
90	### Workspace: def456
91	[LOGIN Rules]
92	- LOGINDISCOVERY: NOT CONFIGURED (Recommended: CRITICAL: Configure and enable this rule to discover unknown login endpoints)
93	- LOGINATTEMPT: IS DISABLED (Recommended: Enable this rule)
94	- LOGINSUCCESS: ENABLED
95	- LOGINFAILURE: ENABLED
96	-> LOGINATTEMPT is not enabled. Searching recent request logs for potential login paths...
97	-> Found potential login paths in last 30 minutes:
98	3 /api/v1/login
99	1 /auth/signin
100	```
101
102	## Error Handling
103
104	\| Error \| Cause \| Fix \|
105	\| --------------------------------- \| ---------------------------- \| ---------------------------------------------- \|
106	\| `FASTLY_API_KEY not set` \| Environment variable missing \| `export FASTLY_API_KEY=<token>` \|
107	\| `API call failed with status 403` \| Token lacks NGWAF scope \| Verify token has `global:read` permission \|
108	\| `No workspaces found` \| NGWAF not provisioned \| Enable NGWAF on the account first \|
109	\| `jq is not installed` \| Missing dependency \| `brew install jq` or `apt-get install -y jq` \|
110
111	## API References
112
113	- [List Workspaces](https://www.fastly.com/documentation/reference/api/ngwaf/workspaces/#ngwafListWorkspaces)
114	- [List Workspace Rules](https://www.fastly.com/documentation/reference/api/ngwaf/rules/#ngwafListWorkspaceRules)

People who liked this also viewed

6 picks

Type

fastly-ngwaf

28stars5forks

View on GitHub

How to install fastly-ngwaf?

fastly/fastly-agent-toolkit/fastly-ngwaf

$npx -y skills add fastly/fastly-agent-toolkit --skill fastly-ngwaf

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Fastly NGWAF Workspace Audit
2
3	Audits NGWAF workspaces to verify critical templated rules are configured and enabled. Use the fastly-cli skill to configure rules; this skill identifies gaps.
4
5	## Quick Start
6
7	Run the bundled assessment script (requires `jq` and `FASTLY_API_KEY`):
8
9	```bash
10	./scripts/assess_ngwaf_rules.sh
11	```
12
13	For manual inspection or partial audits, use the API calls below.
14
15	## Audit Workflow
16
17	1. List workspaces — verify the account has NGWAF workspaces
18	2. Fetch rules per workspace — retrieve each workspace's rule set
19	3. Validate critical signals — confirm required rules exist and are enabled
20	4. Flag gaps and search for uncovered endpoints — report missing/disabled rules
21
22	### Step 1: List Workspaces
23
24	```bash
25	curl -s -H "Fastly-Key: $FASTLY_API_KEY" \
26	"https://api.fastly.com/ngwaf/v1/workspaces?limit=200" \| jq '.data[].id'
27	```
28
29	If empty, NGWAF is not configured for this account.
30
31	### Step 2: Fetch Rules for a Workspace
32
33	```bash
34	curl -s -H "Fastly-Key: $FASTLY_API_KEY" \
35	"https://api.fastly.com/ngwaf/v1/workspaces/$WORKSPACE_ID/rules?limit=200"
36	```
37
38	### Step 3: Validate Critical Signals
39
40	For each workspace, verify these templated rules exist and `enabled` is `true`:
41
42	\| Category \| Required Signals \|
43	\| ---------------------- \| ---------------------------------------------------------------- \|
44	\| Login Protection \| `LOGINDISCOVERY`, `LOGINATTEMPT`, `LOGINSUCCESS`, `LOGINFAILURE` \|
45	\| Credit Card Validation \| `CC-VAL-ATTEMPT`, `CC-VAL-FAILURE`, `CC-VAL-SUCCESS` \|
46	\| Gift Card Validation \| `GC-VAL-ATTEMPT`, `GC-VAL-FAILURE`, `GC-VAL-SUCCESS` \|
47
48	Check a specific signal:
49
50	```bash
51	curl -s -H "Fastly-Key: $FASTLY_API_KEY" \
52	"https://api.fastly.com/ngwaf/v1/workspaces/$WORKSPACE_ID/rules?limit=200" \
53	\| jq '[.data[] \| select(.actions[].signal == "LOGINDISCOVERY") \| {enabled, id}]'
54	```
55
56	### Step 4: Search for Uncovered Login Endpoints
57
58	When `LOGINATTEMPT` is missing or disabled, search recent request logs for login-like traffic the WAF isn't protecting:
59
60	```bash
61	curl -s -H "Fastly-Key: $FASTLY_API_KEY" \
62	"https://api.fastly.com/ngwaf/v1/workspaces/$WORKSPACE_ID/requests?limit=100&page=1&q=from%3A-30min%20method%3APOST%20path%3A~%22%2Alogin%2A%22" \
63	\| jq -r '.data[].path' \| sort \| uniq -c
64	```
65
66	## Expected Output
67
68	Healthy workspace — all signals present and enabled:
69
70	```text
71	### Workspace: abc123
72	[LOGIN Rules]
73	- LOGINDISCOVERY: ENABLED
74	- LOGINATTEMPT: ENABLED
75	- LOGINSUCCESS: ENABLED
76	- LOGINFAILURE: ENABLED
77	[CC Rules]
78	- CC-VAL-ATTEMPT: ENABLED
79	- CC-VAL-FAILURE: ENABLED
80	- CC-VAL-SUCCESS: ENABLED
81	[GC Rules]
82	- GC-VAL-ATTEMPT: ENABLED
83	- GC-VAL-FAILURE: ENABLED
84	- GC-VAL-SUCCESS: ENABLED
85	```
86
87	Unhealthy workspace — missing or disabled rules require remediation:
88
89	```text
90	### Workspace: def456
91	[LOGIN Rules]
92	- LOGINDISCOVERY: NOT CONFIGURED (Recommended: CRITICAL: Configure and enable this rule to discover unknown login endpoints)
93	- LOGINATTEMPT: IS DISABLED (Recommended: Enable this rule)
94	- LOGINSUCCESS: ENABLED
95	- LOGINFAILURE: ENABLED
96	-> LOGINATTEMPT is not enabled. Searching recent request logs for potential login paths...
97	-> Found potential login paths in last 30 minutes:
98	3 /api/v1/login
99	1 /auth/signin
100	```
101
102	## Error Handling
103
104	\| Error \| Cause \| Fix \|
105	\| --------------------------------- \| ---------------------------- \| ---------------------------------------------- \|
106	\| `FASTLY_API_KEY not set` \| Environment variable missing \| `export FASTLY_API_KEY=<token>` \|
107	\| `API call failed with status 403` \| Token lacks NGWAF scope \| Verify token has `global:read` permission \|
108	\| `No workspaces found` \| NGWAF not provisioned \| Enable NGWAF on the account first \|
109	\| `jq is not installed` \| Missing dependency \| `brew install jq` or `apt-get install -y jq` \|
110
111	## API References
112
113	- [List Workspaces](https://www.fastly.com/documentation/reference/api/ngwaf/workspaces/#ngwafListWorkspaces)
114	- [List Workspace Rules](https://www.fastly.com/documentation/reference/api/ngwaf/rules/#ngwafListWorkspaceRules)

People who liked this also viewed

6 picks

Type