Apply a rule set to every request

Create the firewall rule whose Set WAF behavior hands every request to one rule set, from Azion Console, the Azion CLI, or the API.

Last updated

View as Markdown Agent setup

You can create the Rules Engine for Firewall rule that applies a rule set to every request from Azion Console, the Azion CLI, or the API. A rule set scores nothing until a rule names it, and the criterion below skips no request.

Prerequisites

Console

Create the rule

Console

To create the rule from Azion Console:

Open the firewall bound to your workload

Access Azion Console > Firewalls, then select that firewall.

Select the Rules Engine tab
Select + Rule
Name the rule

Enter Apply storefront-waf as the name.

Set the criterion

In the Criteria section, select the Request Uri variable, the starts with operator, and / as the argument.

Add the Set WAF behavior

In the Behaviors section, select Set WAF, then storefront-waf as the rule set and Blocking as the mode.

Save the rule

The rule hands every request the firewall receives to storefront-waf in blocking mode.

For the same rule with the threat families and the mode left open, refer to Create and apply a WAF rule set.

Note — criteria is a list of lists, and a rule carries at most one Set WAF behavior. mode is required on that behavior: a set_waf behavior sent without it is refused with 400 and the error 10059 Required Field, pointing at /data/behaviors/0/attributes/mode. Key the criterion on ${request_uri}, not on the query string. An empty variable does not match, so ${request_args} with the matches operator and .* skips every request carrying no query string, including a POST whose payload sits entirely in the body.

Apply a rule set to selected paths in Logging

A rule set can score only the paths that need it, such as a login form or an API, and start in Logging. Logging scores, records, and serves each request, so the records show what the rule set flags on your own traffic before it refuses anything. The rule matches the paths, not the query string, because a form posts its fields in the body. The example creates the rule set auth-waf, with every threat family at medium, and applies it to /login, /signup, and /checkout. A single criterion on / matches every request. Replace each value with your own.

Console

To create the rule set and apply it:

Create the rule set

Access Azion Console > Edge Libraries > WAF Rules, select + WAF Rule, enter auth-waf as the Name, keep every family at Sensitivity Medium, and select Save.

Create the rule

In the firewall’s Rules Engine tab, select + Rule and enter auth - apply auth-waf.

Match the three paths

In the Criteria section, select Request Uri, starts with, and /login. Add two criteria joined by Or: /signup and /checkout.

Add the Set WAF behavior

In the Behaviors section, select Set WAF, then auth-waf and Logging.

Select Save

Requests to the three paths are scored for attack payloads, and what would be blocked is recorded. Move the rule to Blocking once 3 days of Tuning hold no request that should have been served, as Switch a rule set to blocking describes.

To confirm the rule scores the paths, send an injection-shaped query string to one of them:

curl -i "https://www.example.com/login?q=1%27%20OR%20%271%27%3D%271"

In Logging, the page loads. After the switch to Blocking, the same request receives:

HTTP/2 400

The response’s x-azion-request-id finds the request’s WAF record. For the lookup, refer to Find the WAF score of a blocked request.

In the Protect web applications from OWASP Top 10 and zero-day attacks use case, this section takes these values:

SettingValue
Rulewebapp - apply webapp-waf
CriterionRequest Uri starts with /
BehaviorSet WAF with webapp-waf, in Logging. The API requires the mode, sent as "mode": "logging"

The rule set scores every request the use case’s network rule lets through, and records what would have been blocked. To read those records and turn a false positive into an exception, refer to Tune a WAF rule set.

In the Protect public APIs from abuse use case, this section takes these values:

SettingValue
Ruleapi - apply api-waf
CriterionRequest Uri starts with /v1/
BehaviorSet WAF with api-waf, in Logging, sent in the API as "mode": "logging"

Every request to /v1/ is scored against api-waf, and what would be blocked is recorded.

The Block account takeover on login and checkout flows use case uses the values of this example.

In the Protect web applications from OWASP Top 10 and zero-day attacks use case, expect:

  • WAF scores an attack pattern. From an address that is not listed, a request with an injection-shaped query string, https://www.example.com/?q=1%27%20OR%20%271%27%3D%271, is answered as usual in Logging, and receives HTTP/2 400 after the switch to Blocking. The response’s x-azion-request-id finds the request in the workloadEvents dataset of Real-Time Events, where wafMatch names the internal rules that matched, 1009 and 1013 for this query string. For the lookup, refer to Find the WAF score of a blocked request.

In the Protect public APIs from abuse use case, expect:

  • WAF scores an attack pattern. With a valid token, a request with an injection-shaped query string, https://api.example.com/v1/orders?q=1%27%20OR%20%271%27%3D%271, is answered as usual in Logging, and receives HTTP/2 400 after the switch to Blocking. Its x-azion-request-id finds the record in Real-Time Events.

These checks confirm the Block account takeover on login and checkout flows use case.

In the Prepare regulated web applications for security audits use case, expect:

  • Attack patterns are filtered. Send https://www.example.com/?q=1%27%20OR%20%271%27%3D%271. With the WAF rule in Blocking, the response is 400.

Next steps

Switch a rule set to blockingChange the mode on this behavior after the rule is already in place.Scoring and modesWhere this rule sits in the path a request travels, and what happens after it matches.Protect web applications from OWASP Top 10 and zero-day attacksA web application whose firewall runs network lists, WAF, and Bot Manager in one policy.Protect public APIs from abuseAn API whose rate limit runs last, after WAF, a token check, and Bot Manager.Block account takeover on login and checkout flowsLogin, signup, and checkout scored for automation, then challenged or denied.Prepare regulated web applications for security auditsAn audit setup that exports every request and WAF event to a destination the team keeps.