Switch a rule set to blocking

You can switch the rule that applies a rule set from logging to blocking from the API or Azion Console. The mode belongs to the Set WAF behavior, not to the rule set, so the same rule set can run in logging on one rule and in blocking on another.

Prerequisites

A rule that applies the rule set in logging. To create it, refer to Apply a rule set to every request.
A personal token, for the API request.

Set the mode to blocking

A PUT to /v4/workspace/firewalls/<firewall-id>/request_rules/<rule-id> replaces the rule, so the body carries the criteria too. Send the rule again with mode set to blocking:

JSON

01{

02 "name": "Apply storefront-waf",

03 "active": true,

04 "criteria": [

05 [

06 {

07 "conditional": "if",

08 "variable": "${request_uri}",

09 "operator": "starts_with",

10 "argument": "/"

11 }

12 ]

13 ],

14 "behaviors": [

15 {

16 "type": "set_waf",

17 "attributes": {

18 "waf_id": 12349,

19 "mode": "blocking"

20 }

21 }

22 ]

23}

The rule now refuses a request whose score reaches a threshold with 400, instead of recording it and serving it. A change takes several minutes to reach Azion’s distributed infrastructure, and requests alternate between the old and new behavior while it arrives.

mode takes logging or blocking and nothing else. A body carrying "mode": "learning" is refused with 400 and the error 10039 Invalid Choice, pointing at /data/behaviors/0/attributes/mode. A body with no mode at all is refused with 10059 Required Field at the same pointer.

Note — To change the mode from Azion Console, open the firewall, select the Rules Engine tab and the rule, and set the mode on its Set WAF behavior to Blocking. The full procedure is in Check or change the WAF mode.

Next steps

Apply a rule set to every requestThe rule this change edits, and the criterion it has to keep.Scoring and modesWhat each mode does to a request whose score reaches a threshold.