Check or change the WAF mode

The mode sits on the Set WAF behavior of a Rules Engine rule, not on the rule set. Read it there, and switch it there.

Last updated

View as Markdown Agent setup

You can read the mode of a Web Application Firewall (WAF) rule set, and change it, from Azion Console or the API.

The mode is an attribute of the Set WAF behavior on a Rules Engine for Firewall rule. It is not a field of the rule set. One rule set can therefore run in one mode on one rule, and in another mode elsewhere. Applying a rule set for the first time belongs to Create and apply a WAF rule set.

Select the interface you will use. The prerequisites and both tasks below follow that choice.

Prerequisites

  • A personal token and curl. To create a token, refer to Personal Tokens.
  • The id of the firewall that carries the rule.

Check the mode

A firewall holds several rules, and only the one carrying Set WAF decides the mode. Find that rule first.

To read the mode in Azion Console:

Open the firewall

Access Azion Console > Firewalls, then select the firewall that runs the rule set.

Select the Rules Engine tab
Select the rule that applies the rule set

A rule that applies a rule set to every request reads If Request Uri starts with / under Criteria, and Set WAF under Behaviors.

Read the mode

In the Behaviors section, the Set WAF behavior names the rule set. The mode dropdown beside it shows Logging or Blocking.

That value is the mode every request selected by this rule runs under. A rule carries at most one Set WAF behavior.

To read the mode over the API:

List the rules of the firewall

Replace <firewall-id> with the id of your firewall, and [TOKEN VALUE] with your personal token:

Shell
01curl --request GET \
02 --url https://api.azion.com/v4/workspace/firewalls/<firewall-id>/request_rules \
03 --header 'Accept: application/json' \
04 --header 'Authorization: Token [TOKEN VALUE]'
Find the set_waf behavior

The call answers 200. The rule that applies a rule set reads back with this behavior:

JSON
01"behaviors": [
02 { "type": "set_waf", "attributes": { "waf_id": 12345, "mode": "blocking" } }
03]

mode carries logging or blocking, the two values Azion Console renders as Logging and Blocking. Record the id of that rule. Changing the mode needs it.

Change the mode

The mode has exactly two values, and learning is not one of them. For what each mode does to a request that reaches a threshold, refer to Scoring and modes.

To change the mode in Azion Console:

Open the rule

Reach the rule through the steps in Check the mode.

Open the mode dropdown on the Set WAF behavior
Select Logging or Blocking
Select Save

The rule now names the new mode. The change takes time to reach Azion’s distributed infrastructure. A request that still behaves under the earlier mode has broken nothing: wait, then send it again.

Send the whole set_waf behavior, because mode is required inside it. A behavior that omits mode is refused with 400 and the error 10059 Required Field, on the pointer /data/behaviors/0/attributes/mode.

Send the change

Replace <firewall-id> and <rule-id> with the ids you recorded, and waf_id with the id of your rule set. Send the rule’s complete behaviors array rather than the set_waf entry alone:

Shell
01curl --request PATCH \
02 --url https://api.azion.com/v4/workspace/firewalls/<firewall-id>/request_rules/<rule-id> \
03 --header 'Accept: application/json' \
04 --header 'Authorization: Token [TOKEN VALUE]' \
05 --header 'Content-Type: application/json' \
06 --data {
07 "behaviors": [
08 {
09 "type": "set_waf",
10 "attributes": {
11 "waf_id": 12345,
12 "mode": "logging"
13 }
14 }
15 ]
16}
Read the mode back

Run the GET from Check the mode again, and confirm that mode carries the value you sent.

Any other value is refused. Other Azion surfaces spell this mode learning, and a behavior carrying that value returns:

JSON
01{
02 "errors": [
03 {
04 "code": "10039",
05 "title": "Invalid Choice",
06 "detail": "\"learning\" is not a valid choice.",
07 "status": "400",
08 "source": { "pointer": "/data/behaviors/0/attributes/mode" }
09 }
10 ]
11}

Next steps

Scoring and modesWhat each mode does to a request, and what a blocked request receives.Tune a WAF rule setRead what a rule set matched in Logging and turn a false positive into an exception.Find the WAF score of a blocked requestFind the score and the rule that fired on a request.Troubleshoot FirewallWhat to check when a rule set blocks nothing, or blocks the wrong traffic.