The Three Main Components
Every WAF consists of three primary modules that work together and compose the WAF products or service: the planes
- Data Plane (Data Path)
The Data Plane is where all client requests and server responses flow through the WAF. Since the WAF operates as an inline device, all traffic to and from the web application passes through this component. The Data Plane must sustain high traffic loads while adding minimal latency.
This is where the security “magic” happens – the Data Plane is the focus of this chapter because it contains all the engines that actually detect and prevent attacks.
Data Plane Responsibilities:
- Process all incoming requests and outgoing responses
- Parse HTTP/HTTPS traffic into analyzable components
- Apply detection mechanisms to identify threats
- Execute prevention actions on malicious traffic
- Maintain high performance under load
- Control Plane (Management Layer)
The Control Plane is where administrators configure all aspects of the Data Plane’s behavior. This includes defining policies, setting thresholds, creating rules, and managing the overall security posture.
Configuration Methods:
- Graphical User Interface (GUI) for visual policy management
- API for programmatic control and automation
- Configuration files for bulk changes and versioning
- Command Line Interface (CLI) for advanced operations
- Policy building tools for simplified rule creation
Control Plane Functions:
- Define security policies and rules
- Configure detection thresholds and parameters
- Manage allow/block lists
- Set prevention actions
- Control reporting settings
- Reporting (Visualization Layer)
Without proper reporting, it’s impossible to understand what the WAF is doing or measure its effectiveness. The Reporting component provides visualization of both Data Plane activities and Control Plane configurations.
Four Levels of Reporting:
- Dashboards – High-level overview showing critical metrics and alerts at a glance
- Graphs – Visual representation of traffic patterns, attack trends, and security events over time
- Statistics – Numerical data that composes the graphs, providing detailed metrics
- Logs – Individual request details showing exactly what was blocked and why – on the WAF itself, CM or SaaS logs repos
- Requests repository log – logging all requests – can be done on SEIM
The reporting system enables security teams to:
- Monitor real-time security status
- Investigate security incidents
- Tune policies to reduce false positives
- Demonstrate security value to stakeholders
- Perform forensic analysis after incidents