--- title: "Security engine rulesets" canonical: "https://docs.aryaka.com/space/KNOW/27954008/Security%20engine%20rulesets" format: markdown --- Security rules can be written at the site level or in a ruleset. A ruleset is associated with a site or a group of sites and can include one or more rules. This topic provides an overview of the creation and evaluation of rulesets by Aryaka’s security engines. Security rules and rulesets  You can create security rulesets that can contain multiple security rules and be applied to multiple sites. Security rules control network traffic by inspecting traffic to determine whether it matches established criteria. When traffic matches rule criteria, it can be permitted or denied based on how you have configured the rule.  Match criteria, for example, sources and destinations, web categories and content, and URLs can be specified individually when you create a rule or as part of a named asset, defined on the  Asset Management  page. Assets are reusable objects that can be included in your security rules. Some assets are automatically created by Aryaka when you purchase SASE services, and others are user-defined and managed. You must configure the assets you want to use in your security rules before you configure your security rules.  The Security section includes the following security engines: Next Generation Firewall —Rules that permit, deny, or allow traffic to bypass all subsequent processing.  IPS—Includes the following security engines: WAN-Side Basic IPS —Rules that permit or deny inbound traffic at the public-facing perimeter by inspecting traffic for signatures that indicate a potential threat. LAN-Side Basic IPS —Rules that permit or deny outbound traffic at the LAN perimeter by inspecting traffic for signatures that indicate a potential threat. Advanced IPS —Rules that determine if SSL inspection is required and permit or deny outbound traffic by inspecting it for signatures that indicate a potential threat.  DNS Filtering —Rules that permit or deny DNS traffic based on domain reputation. Secure Web Gateway —Rules that permit, deny, or allow SSL-inspected traffic to bypass all subsequent processing. CASB—Includes the following security engines: SaaS Apps Access Control —Create rules to control access to SaaS applications.  Tenant Restriction —Create rules to manipulate HTTP headers and enforce tenant restrictions for SaaS applications.  SaaS Apps Classification —Specify sanctioned and unsanctioned applications for your organization. Data Loss Prevention —Rules to protect sensitive data. Anti-Malware —Rules that permit or deny file transfers in your network. These security engines have their own configuration pages where rulesets are defined. Select the linked topic to view procedures for creating and editing a security ruleset. Example ruleset configuration The following graphic displays 11 rulesets configured for the Next Generation Firewall security engine: By default, a Global Non-Overridable template and a Default template are included for every security engine. Both of these rulesets apply to all of your sites. You can edit the Global Non-Overridable template, but you cannot edit the Default template. Five High Priority Custom templates and four Normal Priority Custom templates are also configured.  The rulesets included in this example are for instructional purposes only. You should configure your security rules based on your organization's needs. Rulesets can be configured with multiple rules and can be associated with multiple sites. The following graphic displays the details for a Normal Priority Custom template configured for the Next Generation Firewall security engine: This ruleset contains one rule and is associated with one site. The rule included in this ruleset is configured with the Permit action, which permits any traffic that is matched by the rule. If traffic is evaluated by this rule, it means that it did not match any of the rules in the Global Non-Overridable template for the Next Generation Firewall rule table. This rule matches any traffic destined for port 443, 8080, 8443, or 80 and permits it. If traffic does not match this rule, the next rule in the site's rule table is evaluated. To view the rule tables for a specific site, navigate to the Sites > Security page. See the Configure site-level security features topic for more detail.  Rule evaluation order There are four types of security rulesets. The following descriptions are ranked by the evaluation priority of each ruleset type. Global Non-Overridable Template—Contains rules that apply to all sites. The rules in this ruleset have the highest evaluation ranking and no rules can be placed above those in this ruleset. This allows you to specify a single set of non-overridable rules for all sites for a specific security engine. All security engines include this ruleset by default—it is configured by Aryaka and you cannot delete it. This ruleset is empty by default, but you can rename it and add, edit, or remove rules from it. Only one ruleset of this type can be configured for a given security engine. High Priority Custom Template—Contains rules that apply to specific sites. Only rules in the Global Non-Overridable template take precedence over the rules in this ruleset, allowing you to define a separate set of high priority rules for a specific site and security engine. You can configure multiple rulesets of this type for a given security engine, but a site can have at most one ruleset of this type for a given security engine. Normal Priority Custom Template—Contains ruels that apply to specific sites. The rules in this ruleset are evaluated after all rules in Global Non-Overridable and High Priority Custom templates. The rules in this ruleset can be overridden by site-level rules and rules in other Normal Priority Custom templates, based on your configured evaluation order. You can configure multiple rulesets of this type for a given security engine and site. Default Template—Contains rules that apply to all sites. Rules included in this ruleset are evaluated after all other rulesets and site-level rules. This ruleset type is configured and managed by Aryaka. To override rules in the Default template, create a custom site-level rule or configure a rule in one of the other ruleset types. The rule list within a ruleset is evaluated from top to bottom. If a more specific rule appears above a more generic rule, and the traffic matches the more specific rule, the rule's corresponding action is executed and the evaluation is  not  performed on the next (more generic) rule. See the following section for an example ruleset configuration. In this topic Related topics Getting Started with Aryaka Unified SASE Security NGFW-SWG Security rule match criteria Asset management Configure site-level security features