Apply a rule set to every request

Create the firewall rule whose Set WAF behavior hands every request to one rule set, from Azion Console, the Azion CLI, or the API.

Last updated

View as Markdown Agent setup

You can create the Rules Engine for Firewall rule that applies a rule set to every request from Azion Console, the Azion CLI, or the API. A rule set scores nothing until a rule names it, and the criterion below skips no request.

Prerequisites

  • A firewall bound to your workload, with WAF turned on in its main settings.
  • A rule set to apply, such as storefront-waf. To create one, refer to Create a rule set at medium sensitivity.
  • The Azion CLI installed and a configured personal token, for the CLI procedure.
  • A personal token, for the API request.

Create the rule

To create the rule from Azion Console:

Open the firewall bound to your workload

Access Azion Console > Firewalls, then select that firewall.

Select the Rules Engine tab
Select + Rule
Name the rule

Enter Apply storefront-waf as the name.

Set the criterion

In the Criteria section, select the Request Uri variable, the starts with operator, and / as the argument.

Add the Set WAF behavior

In the Behaviors section, select Set WAF, then storefront-waf as the rule set and Blocking as the mode.

Save the rule

The rule hands every request the firewall receives to storefront-waf in blocking mode.

For the same rule with the threat families and the mode left open, refer to Create and apply a WAF rule set.

Note — criteria is a list of lists, and a rule carries at most one Set WAF behavior. mode is required on that behavior: a set_waf behavior sent without it is refused with 400 and the error 10059 Required Field, pointing at /data/behaviors/0/attributes/mode. Key the criterion on ${request_uri}, not on the query string. An empty variable does not match, so ${request_args} with the matches operator and .* skips every request carrying no query string, including a POST whose payload sits entirely in the body.

Next steps

Switch a rule set to blockingChange the mode on this behavior after the rule is already in place.Scoring and modesWhere this rule sits in the path a request travels, and what happens after it matches.