WAF quickstart

Create a rule set, apply it to a firewall with a Set WAF behavior, and confirm that an injection-shaped request is refused.

Last updated

View as Markdown Agent setup

This guide instructs you through scoring your first request against Web Application Firewall (WAF).

  • Create a rule set that carries eight threat families at medium sensitivity.
  • Apply that rule set to a firewall with a Set WAF behavior in blocking mode.
  • Send an injection-shaped request and read the refusal.

Four objects put a request under inspection, and each one links to the next:

  1. The rule set holds the threat families and the sensitivity chosen for each.
  2. The firewall carries the WAF module, and the workload serving your application is bound to that firewall.
  3. The Rules Engine rule on that firewall carries a Set WAF behavior, which names the rule set and the mode.
  4. The request is what WAF then scores against the rule set.

A rule set inspects nothing on its own. Until a Rules Engine rule names it, no request is scored.

Select the interface you will use. The prerequisites and every stage below follow that choice.

Prerequisites

Create the WAF rule set

The rule set holds what to detect. It carries eight threat families, and each family has a sensitivity level that fixes the score at which it blocks. Every family starts at medium, which is the level this guide uses.

To create the rule set in Azion Console:

Open the WAF Rules page

Access Azion Console > Edge Libraries > WAF Rules.

Select + WAF Rule
Name the rule set

In the General section, enter a Name. For example: storefront-waf.

Leave every family at its default sensitivity

The Threat Type Configuration section lists eight threat families. Each one opens on Sensitivity Medium.

Keep the Active switch turned on
Save the rule set

The rule set appears in WAF Rules, which lists its Threat Type Configuration, Status, Last Editor, and Last Modified.

The Azion CLI creates a complete rule set from a name alone. To create it:

Run the create command
azion create waf --name "storefront-waf"
Read the output

The command prints the id of the new rule set:

Created WAF with ID 12349

The rule set is active, it runs on ruleset 1, and it carries all eight threat families at medium. Record the id. You pass it to the rule.

The request body carries the eight threat families and the sensitivity for each.

Send the create request

Replace [TOKEN VALUE] with your personal token:

Shell
01curl --request POST \
02 --url https://api.azion.com/v4/workspace/wafs \
03 --header 'Accept: application/json' \
04 --header 'Authorization: Token [TOKEN VALUE]' \
05 --header 'Content-Type: application/json' \
06 --data {
07 "name": "storefront-waf",
08 "active": true,
09 "product_version": "1.0",
10 "engine_settings": {
11 "engine_version": "2021-Q3",
12 "type": "score",
13 "attributes": {
14 "rulesets": [1],
15 "thresholds": [
16 { "threat": "cross_site_scripting", "sensitivity": "medium" },
17 { "threat": "directory_traversal", "sensitivity": "medium" },
18 { "threat": "evading_tricks", "sensitivity": "medium" },
19 { "threat": "file_upload", "sensitivity": "medium" },
20 { "threat": "identified_attack", "sensitivity": "medium" },
21 { "threat": "remote_file_inclusion", "sensitivity": "medium" },
22 { "threat": "sql_injection", "sensitivity": "medium" },
23 { "threat": "unwanted_access", "sensitivity": "medium" }
24 ]
25 }
26 }
27}
Read the response

A create answers 202, not 201, and "state": "pending" means the change is still propagating:

JSON
01{
02 "state": "pending",
03 "data": {
04 "id": 12349,
05 "active": true,
06 "name": "storefront-waf",
07 "last_editor": "user@example.com",
08 "last_modified": "2026-01-01T12:00:00.000000Z",
09 "product_version": "1.0",
10 "engine_settings": {
11 "engine_version": "2021-Q3",
12 "type": "score",
13 "attributes": {
14 "rulesets": [1],
15 "thresholds": [
16 { "threat": "cross_site_scripting", "sensitivity": "medium" },
17 { "threat": "directory_traversal", "sensitivity": "medium" },
18 { "threat": "evading_tricks", "sensitivity": "medium" },
19 { "threat": "file_upload", "sensitivity": "medium" },
20 { "threat": "identified_attack", "sensitivity": "medium" },
21 { "threat": "remote_file_inclusion", "sensitivity": "medium" },
22 { "threat": "sql_injection", "sensitivity": "medium" },
23 { "threat": "unwanted_access", "sensitivity": "medium" }
24 ]
25 }
26 },
27 "version_id": null,
28 "version_state": null,
29 "is_versioned": false,
30 "version": null
31 }
32}

Record the id. You pass it to the rule.

Apply the rule set with a Rules Engine rule

A Rules Engine for Firewall rule selects requests by its own criteria. Its Set WAF behavior then names one rule set and one mode. The rule below applies your rule set to every request the firewall receives.

The mode is required, and it belongs to the behavior rather than to the rule set. Blocking refuses a request whose score reaches a threshold. Logging records the same request and serves it. This guide uses Blocking.

To apply the rule set in Azion Console:

Open the firewall bound to your workload

Still in Azion Console, go to Firewalls and select that firewall.

Select the Rules Engine tab
Select + Rule
Name the rule

Enter a name for the rule. For example: Apply storefront-waf.

Set the criterion

In the Criteria section, select the Request Uri variable, the starts with comparison operator, and / as the argument.

Add the Set WAF behavior

In the Behaviors section, select Set WAF, then select the rule set you created.

Select Blocking as the mode
Save the rule

The firewall now scores every request it receives against the rule set. A rule carries at most one Set WAF behavior.

azion create firewall-rule reads the whole rule from a JSON file. It has no flag for a behavior or a mode.

Write the rule to a file

Save the following as fw-rule.json, with the id of your rule set in waf_id:

JSON
01{
02 "name": "Apply storefront-waf",
03 "active": true,
04 "description": "",
05 "criteria": [
06 [
07 {
08 "conditional": "if",
09 "variable": "${request_uri}",
10 "operator": "starts_with",
11 "argument": "/"
12 }
13 ]
14 ],
15 "behaviors": [
16 {
17 "type": "set_waf",
18 "attributes": {
19 "waf_id": 12349,
20 "mode": "blocking"
21 }
22 }
23 ]
24}
Create the rule

Replace <firewall-id> with the id of your firewall:

azion create firewall-rule --firewall-id <firewall-id> --file fw-rule.json
Read the output

The command prints the id of the new rule:

Created Firewall Rule with ID 123457

The firewall now scores every request it receives against the rule set.

The criteria carry ${request_uri}, so the body is sent from a file.

Write the rule to a file

Save the following as rule.json, with the id of your rule set in waf_id:

JSON
01{
02 "name": "Apply storefront-waf",
03 "active": true,
04 "criteria": [
05 [
06 {
07 "conditional": "if",
08 "variable": "${request_uri}",
09 "operator": "starts_with",
10 "argument": "/"
11 }
12 ]
13 ],
14 "behaviors": [
15 {
16 "type": "set_waf",
17 "attributes": {
18 "waf_id": 12349,
19 "mode": "blocking"
20 }
21 }
22 ]
23}
Send the create request

Replace <firewall-id> with the id of your firewall:

Shell
01curl --request POST \
02 --url https://api.azion.com/v4/workspace/firewalls/<firewall-id>/request_rules \
03 --header 'Accept: application/json' \
04 --header 'Authorization: Token [TOKEN VALUE]' \
05 --header 'Content-Type: application/json' \
06 --data @rule.json
Read the response

A 202 carries the rule, with the order it holds among the rules of the firewall:

JSON
01{
02 "state": "pending",
03 "data": {
04 "id": 123456,
05 "name": "Apply storefront-waf",
06 "last_editor": "user@example.com",
07 "last_modified": "2026-01-01T12:00:00.000000Z",
08 "created_at": "2026-01-01T12:00:00.000000Z",
09 "active": true,
10 "criteria": [
11 [
12 {
13 "conditional": "if",
14 "variable": "${request_uri}",
15 "operator": "starts_with",
16 "argument": "/"
17 }
18 ]
19 ],
20 "behaviors": [
21 {
22 "type": "set_waf",
23 "attributes": {
24 "waf_id": 12349,
25 "mode": "blocking"
26 }
27 }
28 ],
29 "description": "",
30 "order": 1
31 }
32}

A body that omits mode is refused with 400 and the error 10059 Required Field, pointing at /data/behaviors/0/attributes/mode.

Verify that WAF blocks a request

The check is the same whichever interface built the rule. Your workload answers on a domain of the form <id>.map.azionedge.net, written below as <your-workload-domain>.

A new binding takes time to reach Azion’s distributed infrastructure. Expect close to six minutes before the rule takes effect. The domain then answers inconsistently for several minutes, while the change arrives in different places. A request that still returns the earlier response has broken nothing: wait, then send it again.

Send a clean request first:

curl -i https://<your-workload-domain>/

The request is not scored as a threat and reaches the application, which answers it:

HTTP/2 200

Your own application decides that status. What matters is that the request is not refused.

Now send an injection-shaped request, carrying 1' OR '1'='1 in the query string:

curl -i "https://<your-workload-domain>/?q=1%27%20OR%20%271%27%3D%271"

WAF refuses it:

Text
01HTTP/2 400
02content-type: text/html
03x-azion-request-id: 0123456789abcdef0123456789abcdef

The body is Azion’s default error page, headed Bad Request. Nothing in the response names WAF, the rule that matched, or the score. Record x-azion-request-id: that value finds the request in Real-Time Events.

That request tripped the internal rules 1009 and 1013, both on the q argument. It scored under the SQL injection and cross-site scripting families. Your rule set is now scoring traffic.

Next steps

Scoring and modesThe path a request travels, the scoring model, and what each mode does.Firewall best practicesWhy production starts in Logging rather than the Blocking this guide used, and what each practice costs.Tune a WAF rule setRead what a rule set matched and turn a false positive into an exception.Exempt one query string parameterTake one argument out of the scoring of one internal rule, the first time a legitimate request is blocked.Apply a rule set to every requestThe rule that binds a rule set to a firewall, for the next firewall that needs one.Firewall limitsThe bounds a rule set operates within, and the usage each service plan includes.