Create a rule set at medium sensitivity

You can create a WAF rule set with every threat family at medium from Azion Console, the Azion CLI, or the API. medium is the level a family opens on, and the one to start from before any traffic has told you to raise a family.

Prerequisites

Console

Access to Azion Console. Refer to Access Azion Console.

CLI

The Azion CLI installed and a configured personal token.

API

A personal token.

Create the rule set

Console

To create the rule set from Azion Console:

Open the WAF Rules page

Access Azion Console > Edge Libraries > WAF Rules.

Select + WAF Rule

Name the rule set

In the General section, enter storefront-waf in Name.

Leave every threat family at its default sensitivity

The Threat Type Configuration section lists the eight families, each opening on Sensitivity Medium.

Keep the Active switch turned on

Save the rule set

The rule set storefront-waf is active with all eight threat families at medium, ready to be named in a Set WAF behavior.

For the same rule set with one family raised above medium, refer to Create and apply a WAF rule set.

CLI

To create the rule set with the Azion CLI:

azion create waf --name "storefront-waf"

Created WAF with ID 12351

The output reports the id of the new rule set, which is the value a Set WAF behavior names. A create from the name alone is complete: the rule set comes back active, on ruleset 1 with engine version 2021-Q3 and engine type score, with all eight families at medium.

API

Send a POST request to the WAF rule sets endpoint:

Shell

01curl --request POST \

02 --url https://api.azion.com/v4/workspace/wafs \

03 --header 'Accept: application/json' \

04 --header 'Authorization: Token [TOKEN VALUE]' \

05 --header 'Content-Type: application/json' \

06 --data {

07 "name": "storefront-waf",

08 "active": true,

09 "product_version": "1.0",

10 "engine_settings": {

11 "engine_version": "2021-Q3",

12 "type": "score",

13 "attributes": {

14 "rulesets": [1],

15 "thresholds": [

16 { "threat": "cross_site_scripting", "sensitivity": "medium" },

17 { "threat": "directory_traversal", "sensitivity": "medium" },

18 { "threat": "evading_tricks", "sensitivity": "medium" },

19 { "threat": "file_upload", "sensitivity": "medium" },

20 { "threat": "identified_attack", "sensitivity": "medium" },

21 { "threat": "remote_file_inclusion", "sensitivity": "medium" },

22 { "threat": "sql_injection", "sensitivity": "medium" },

23 { "threat": "unwanted_access", "sensitivity": "medium" }

24 ]

25 }

26 }

27}

The API answers 202 and echoes the object under data, where "state": "pending" means the change is still propagating. Record data.id: that is the value a Set WAF behavior names.

The API accepts fewer than eight entries in thresholds, and an array holding one entry creates a rule set that scores only that family. List every family you want scored.

For what a sensitivity level changes, and the threshold each level sets, refer to Scoring and modes and WAF Rule Sets.

In the Protect web applications from OWASP Top 10 and zero-day attacks use case, this section takes these values:

Setting	Value
Rule set	`webapp-waf`, every threat family at Sensitivity Medium

In the Protect public APIs from abuse use case, this section takes these values:

Setting	Value
Rule set	`api-waf`, every threat family at Sensitivity Medium

In the Block account takeover on login and checkout flows use case, this section takes these values:

Setting	Value
Rule set	`auth-waf`, every threat family at Sensitivity Medium

Next steps

Apply a rule set to every requestPut this rule set in front of a request, which nothing does until a Rules Engine rule names it.WAF Rule SetsEvery field a rule set carries, the eight threat families, and the five sensitivity levels.Protect web applications from OWASP Top 10 and zero-day attacksA web application whose firewall runs network lists, WAF, and Bot Manager in one policy.Protect public APIs from abuseAn API whose rate limit runs last, after WAF, a token check, and Bot Manager.Block account takeover on login and checkout flowsLogin, signup, and checkout scored for automation, then challenged or denied.