Create a rule set at medium sensitivity

You can create a WAF rule set with every threat family at medium from Azion Console, the Azion CLI, or the API. medium is the level a family opens on, and the one to start from before any traffic has told you to raise a family.

Prerequisites

The Azion CLI installed and a configured personal token, for the CLI procedure.
A personal token, for the API request.

Create the rule set

To create the rule set from Azion Console:

Open the WAF Rules page

Access Azion Console > Edge Libraries > WAF Rules.

Select + WAF Rule

Name the rule set

In the General section, enter storefront-waf in Name.

Leave every threat family at its default sensitivity

The Threat Type Configuration section lists the eight families, each opening on Sensitivity Medium.

Keep the Active switch turned on

Save the rule set

The rule set storefront-waf is active with all eight threat families at medium, ready to be named in a Set WAF behavior.

For the same rule set with one family raised above medium, refer to Create and apply a WAF rule set.

To create the rule set with the Azion CLI:

azion create waf --name "storefront-waf"

Created WAF with ID 12351

The output reports the id of the new rule set, which is the value a Set WAF behavior names. A create from the name alone is complete: the rule set comes back active, on ruleset 1 with engine version 2021-Q3 and engine type score, with all eight families at medium.

Send a POST request to the WAF rule sets endpoint:

Shell

01curl --request POST \

02 --url https://api.azion.com/v4/workspace/wafs \

03 --header 'Accept: application/json' \

04 --header 'Authorization: Token [TOKEN VALUE]' \

05 --header 'Content-Type: application/json' \

06 --data {

07 "name": "storefront-waf",

08 "active": true,

09 "product_version": "1.0",

10 "engine_settings": {

11 "engine_version": "2021-Q3",

12 "type": "score",

13 "attributes": {

14 "rulesets": [1],

15 "thresholds": [

16 { "threat": "cross_site_scripting", "sensitivity": "medium" },

17 { "threat": "directory_traversal", "sensitivity": "medium" },

18 { "threat": "evading_tricks", "sensitivity": "medium" },

19 { "threat": "file_upload", "sensitivity": "medium" },

20 { "threat": "identified_attack", "sensitivity": "medium" },

21 { "threat": "remote_file_inclusion", "sensitivity": "medium" },

22 { "threat": "sql_injection", "sensitivity": "medium" },

23 { "threat": "unwanted_access", "sensitivity": "medium" }

24 ]

25 }

26 }

27}

The API answers 202 and echoes the object under data, where "state": "pending" means the change is still propagating. Record data.id: that is the value a Set WAF behavior names.

The API accepts fewer than eight entries in thresholds, and an array holding one entry creates a rule set that scores only that family. List every family you want scored.

For what a sensitivity level changes, and the threshold each level sets, refer to Scoring and modes and WAF Rule Sets.

Next steps

Apply a rule set to every requestPut this rule set in front of a request, which nothing does until a Rules Engine rule names it.WAF Rule SetsEvery field a rule set carries, the eight threat families, and the five sensitivity levels.