Package: cwafctl
cwafctlcwafctlis a command-line utility that interfaces with Radware Cloud WAF over REST API. It allows to manage Cloud WAF from the CLI.cwafctlworks with yaml, it allows you to retrieve information in yaml format, that you can save to a file, modify and later on re-use to update the object. The yaml objects used by cwafctl are mapped directly to the JSON format supported by Cloud WAF for API calls.cwafctlrequirespython 3.8to run and was tested using windows 10.How to installYou can use the python package installer "pip" to deploy cwafctl:pip install cwafctlIn order to configure your user name and password, please use the following command initially:cwafctl utils setUserNameAndPassword --username="username@domain.com" --password="password"where username and password are Radware Cloud WAF API credentials. It will store those credentials in the user home folder.For instructions on how to create an API user in Cloud WAF, please consulthttps://portals.radware.com/ProductDocumentation/Cloud_WAF_API_User_Guide/index.html#page/Cloud%20WAF%20API%20User%20Guide/Cloud%20WAF%20API%20Users%20Guide%20v6_AB.1.09.htmlHow to usecwafctl basically implements the commands below:get:    Allows to retrieve a configurationcreate:  Allows to deploy new configurations (ex.:new application,certificate,etc.)delete:  Allows to delete an objectset:     Allows to modify an existing configurationutils:   Misc utilitiesRetrieving objects using the "get" commandcwafctl currently allows to retrieve the following objects from Radware Cloud WAF:ObjectDescriptionactivity_logsGets the activity logs in YAMLapplicationGets an application configuration by name in YAMLapplication_access_rulesGets the application's access rules settings in YAMLapplication_aclGets an application ACL by name in YAMLapplication_dns_recordsGets the application's dns diversion records in YAMLapplication_domainGets an application's main domain name in YAMLapplication_generalinfoGets an application's general info by name in YAMLapplication_network_configurationGets an application's  service settings such as services, certificate and health checksapplication_ip_persistencyGets the application's persistency settings in YAMLapplication_origin_serversGets the application's origin servers settings in YAMLapplication_protection_allowed_urlsGets the application's allowed URLs protection settings in YAMLapplication_protection_anonymous_proxyGets the application's Anonymous proxy blocking protection settings in YAMLapplication_protection_anti_botGets the application's anti-bot protection settings in YAMLapplication_protection_apiGets the application's API protection settings in YAMLapplication_protection_databaseGets the application's database protection settings in YAMLapplication_protection_ddosGets the application's ddos protection settings in YAMLapplication_protection_ert_attackers_feedGets the application's ert attackers feed settings in YAMLapplication_protection_http_complianceGets the application's HTTP compliance protection settings in YAMLapplication_protection_vulnerabilitiesGets the application's vulnerability protection settings in YAMLapplication_protocol_securityGets an application protocol security info (ex.:TLS settings) in YAMLapplication_protocols_and_health_checksGets an application protocol and health checks in YAMLapplication_security_bypassGets the application's security bypass settings in YAMLapplication_security_pageGets the application's blocking page settings in YAMLapplication_true_client_ipGets the application's true client ip settings in YAMLapplication_certificate_fingerprintGets an application's associated certificate fingerprintapplication_v2Gets an application v2 configuration by name in YAMLapplicationsGets the current list of applications in YAML formatavailable_regionsGets a list of the available regions for this customer account. Useful to get the right region codes before deploying an app.bad_botsGets the list of observed bad bots for the application name providedcertificatesGets the list of certificates deployed in CWAF in YAML formatcustomer_infoGets the customer information for the current account.events_ddosRetrieves DDoS events from Cloud WAFevents_wafRetrieves WAF events from Cloud WAFlegitimate_botsGets the list of observed legitimate bots for the application name providedpolicy_distributionGet policy distribution settings in YAMLsearch_engine_botsGets the list of search engine bots observed for the application name providedtemplates_geo_blockingGets geoblocking policies templates in YAMLtemplates_ip_groupsGet IP group templates in YAMLtemplates_security_policiesGet security policies templates in YAMLuserGets a specific user information by first name and last nameusersGets a list of users in Cloud WAFIn order to list applications currently onboarded on your cloud waf account and retrieve the information in yaml format:cwafctl get applicationsThis an example of the CLI output:applications:
    - accountId: 607b9775-a04a-4efa-ba97-228909abc300
      accountName: US Region PoCs
      applicationId: 9d8213f6-580f-406c-9bda-618ef9b3896d
      applicationName: Juice Shop
      creationDate: 1617758940383
      customDeployment: false
      deploymentStatus: PROTECTING
      frontend: alcon
      mainDomain: juice-shop.herokuapp.com
      region: North America (Ashburn)
    - accountId: 607b9775-a04a-4efa-ba97-228909abc300
      accountName: US Region PoCs
      applicationId: db3718bc-de94-40c1-9adf-300a41069e44
      applicationName: rs_hackazon
      creationDate: 1598545097301
      customDeployment: false
      deploymentStatus: PROTECTING
      frontend: alcon
      mainDomain: rsamazon.ddns.net
      region: North America (Ashburn)
    ....
    numberOfElements: 7
    page: 0
    totalElements: 7
    totalPages: 1You can dump the content directly to a yaml file by using the following syntax:cwafctl get applications > applications.yamlIn order to list certificates deployed in your account and dump it to a yaml file:cwafctl get certificates > certificates.yamlIn order to get a specific application configuration and dump it to a yaml file:cwafctl get application "HacmeBank" > hacmebankapp.yamlTo get the full list of available commands and objects that are retrievable:cwafctl get --helpTo get help on a specific command, you can use the following syntax:cwafctl get application --helpCLI Output:python cwafctl get application --help
INFO: Showing help with the command 'cwafctl get application -- --help'.

NAME
    cwafctl get application - Gets an application configuration by name in YAML

SYNOPSIS
    cwafctl get application NAME

DESCRIPTION
    Gets an application configuration by name in YAML

POSITIONAL ARGUMENTS
    NAME

NOTES
    You can also use flags syntax for POSITIONAL ARGUMENTSDeploying a new application in Cloud WAF using cwafctl and the create commandcwafctl currently allows to create (deploy) the following objects:ObjectDescriptionapplicationDeploys an application using a configuration stored in a yaml file ex.: cwafctl create application < newapp.yaml . See the /yaml files/newapp.yaml for an example.certificateDeploys an certificate using a configuration stored in a yaml file. ex.: cwafctl.py create certificate < certificate.yaml . See the /yaml files/certificate.yaml for an example.To deploy the certificate:cwafctl create certificate < ./"yaml files"/certificate.yamlTo deploy the application:cwafctl create application < ./"yaml files"/newapp.yamlThe "yaml files" folder contains yaml files that are usable to deploy a certificate specified in the certificate.yaml file along with a newapp.yaml file that specifies where to deploy the app. Those files can be edited and updated to match with your applications required deployment parameters.newapp.yamlfile content:applicationName: My application
    mainDomain: www.test.com
    protocol: BOTH
    region: CANADA_1
    originServers:
    - address: 2.2.2.2
      addressType: IP
    - address: 3.3.3.3
      addressType: IP
    generalInfo:
      ownerName: Christian Shink
      ownerEmail: christian.shink@test.com
      externalID: '123445'
      description: test
    fingerprint: 87FE361698CB3F47683245984DDAF08E334818D3Please note that the sha1 "fingerprint" field above can be calculated before the deployment using the following command:cwafctl utils get_certificate_fingerprint < ./"yaml files"/certificate.yamlPlease note that the available region codes can be obtained from cloud waf using the following commands:cwafctl get available_regionsCLI output:- CANADA_1
- US_EAST_1
- US_CENTRAL_1Please note that the "certificate.yaml" file can either be created manually using the same format as in ./"yaml files"/certificate.yaml or be generated using the following command:cwafctl utils generate_yaml_cert_file certificate.pem key.pem certchain.pem test > certificate.yamlwhere certificate.pem is the file containing the public keywhere key.pem is the file containing the private keywhere certchain.pem is the file containing the certificate chainwhere test is the passphrase that was used to encrypt the certificateModifying existing configuration using the "set" commandThe following objects can be updated in Radware Cloud WAF using cwafctlsetcommand:ObjectDescriptionapplication_access_rulesUpdates an application's access rules settings section via YAMLapplication_domainUpdates an application's domain name section via YAMLapplication_generalinfoUpdates an application's general information section via YAMLapplication_network_configurationUpdates an application's network configuration, including services (HTTP,HTTPS), certificate and health checks via YAMLapplication_ip_persistencyUpdates an application's ip persistency settings section via YAMLapplication_origin_serversUpdates an application's origin server settings section via YAMLapplication_protection_allowed_urlsUpdates an application's allowed urls protection section via YAMLapplication_protection_anonymous_proxyUpdates an application's anonymous proxy protection section via YAMLapplication_protection_databaseUpdates an application's database protection section via YAMLapplication_protection_vulnerabilitiesUpdates an application's vulnerabilities protection section via YAMLapplication_protocol_securityUpdates an application' protocols security configuration  section via YAMLapplication_protocols_and_health_checksUpdates an application protocol and health checks in YAMLapplication_security_bypassUpdates an application's security bypass settings section via YAMLapplication_security_pageUpdates an application's security page via YAMLapplication_true_client_ipUpdates an application' True Client IP settings section via YAMLapplication_certificate_by_fingerprintUpdates the certificate in use by an application using a certificate fingerprint of an already uploaded certificate.Any "get" command for the corresponding objects can be used to retrieve an object that can be stored and edited locally and later pushed using the "set" command.For example:The following commands retrieve the "general information section of an application" and wil store it to a yaml filecwafctl get application_generalinfo "HacmeBank" > generalInfo.yamlThe content of the yaml file is the following:description: null
externalID: null
ownerEmail: null
ownerName: Christian ShinkThe field "description" can be modified and edited  and the content becomes the folowing :description: HacmeBank application
externalID: null
ownerEmail: null
ownerName: Christian Shinkonce the field has been edited, the new General Info for the application "HacmeBank" can be set using the following command:cwafctl set application_generalinfo "HacmeBank" < generalInfo.yamlDeleting objects using the "delete" commandcwafctl currently supports deleting applications and certificates from Radware Cloud WAF. The 2 examples below illustrate how to use the commands.To delete a certificate:cwafctl delete certificate FINGERPRINTwhereFINGERPRINTis the SHA1 fingerprint of the public key. Certificate fingerprints can be extracted from Cloud WAF using the command:cwafctl get certificates"To delete an application:cwafctl delete application APPNAMEwhereAPPNAMEis the application name.Retrieving security events from Radware Cloud WAFYou can retrieve waf events from Cloud WAF by using the following command:cwafctl get events_wafIt will retrieve the top 10000 events ordered by date. You can in addition scope the search to a specific source IP or protected application by using the --sourceIP and --applicationName parameters.You can retrieve ddos events from Radware Cloud WAF using the following command:cwafctl get events_ddosIt will retrieve the top 10000 events ordered by date. You can in addition scope the search to a specific source IP or destination IP or application by using the flags --sourceIP, --destinationIP and --applicationName.For customers using the Radware BOT manager integrated in Cloud WAF. You can retrieve the current list of bad bots using the following command:cwafctl get bad_bots "appName"where "appName" is the name of the application protected by Cloud WAF.For customers using the Radware BOT manager integrated in Cloud WAF. You can retrieve the list of legitimate bots using the following command:cwafctl get legitimate_bots "appName"where "appName" is the name of the application protected by Cloud WAF.For customers using the Radware BOT manager integrated in Cloud WAF. You can retrieve the list of search engines using the following command:cwafctl get search_engine_bots "appName"where "appName" is the name of the application protected by Cloud WAF.Renewing a certificate for an application deployed in Cloud WAFcwafctl includes a utility that allows to easily upload a new certificate to Cloud WAF and to delete the old one :cwafctl utils updateCertificate --publicKeyFilePath='certificate2.pem' --privateKeyFilePath='key2.pem' --certChainFilePath="chain.pem" --appName='TestDotCom' --passphrase='pass'wherepublicKeyFilePathis  the path to a pem file containing the certificate.whereprivateKeyFilePathis the path to a pem file containing the key.wherecertChainFilePathis the path to a pem file containing the certificate chain.wherepassphraseis the passphrase used to encrypt the key.whereappNameis the application name as deployed in Cloud WAF.certChainFilePathandpassphraseare optional parameters.