Purpose
This guide explains how to configure the Havelsan Kalkan WAF Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, update a cloud WAF service's negative security ruleset directly from a Logsign Incident. This is a Response (action) integration, configured under Settings > Integrations > Responses > +Device.
Prerequisites
- A Havelsan Kalkan WAF deployment with its management API reachable from the Logsign server.
- An account with permission to modify WAF ruleset configuration.
Step 1: Prepare Kalkan WAF for API Access
- Log in to the Kalkan WAF management console with an administrator account.
- Create (or designate) a dedicated account for Logsign to use, and note its username and password.
- Note the WAF management host address.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Havelsan Kalkan WAF, click Configure then +Device, and fill in:
| Field | Description |
|---|---|
| Device Name | Free-text label identifying this Kalkan WAF device in Logsign. |
| Host | Management host address of your Kalkan WAF. Include the http:// or https:// scheme explicitly; a value without one is rejected. |
| Username | The account username from Step 1. |
| Password | Password for that account. Stored encrypted at rest. |
The underlying configuration schema does not formally mark any of these fields as required, but all three (Host, Username, Password) are functionally necessary for the integration to connect; fill in all three and click Create to save the device.
Available Methods
- update-cwaf-service (Containment) — updates a cloud WAF service's negative security ruleset. Args (both required): name (the WAF service to update), negative_rules (an array of rule categories to enable, such as IP reputation, SQL injection, XSS, and DoS protection rules).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong Username/Password. | Re-enter the Username and Password fields and confirm the account can log in to the Kalkan WAF console directly. |
| 403 Forbidden | The account does not have permission to modify WAF service configuration. | Confirm the account's role in Kalkan WAF includes configuration/ruleset management. |
| update-cwaf-service fails to find the service | Wrong name value. | Confirm the name matches an existing cloud WAF service exactly as configured in Kalkan WAF. |
Notes and Limits
- This integration only has one method, updating the negative security ruleset for a named service; it has no method to view the current ruleset before changing it, so track your intended rule state outside Logsign if you need to confirm changes were applied as expected.
- The exact console navigation path for creating a dedicated account was not independently verified against a live Kalkan WAF deployment during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.