Rule sets

A rule set is the object that holds what Web Application Firewall (WAF) looks for: the threat families it scores a request against, and the sensitivity level that turns a score into a block. Azion Console lists these under WAF Rules; the Azion API and the Azion CLI call the same object a waf.

A rule set does not act on its own. It runs when a rule in Rules Engine for Firewall carries the Set WAF behavior naming it, together with a mode of Logging or Blocking. The mode belongs to that rule and not to the rule set, so one rule set runs in Logging on one rule and in Blocking on another. For more information, refer to Scoring and modes.

This page lists the fields of a rule set, the eight threat families it scores, the five sensitivity levels and their thresholds, the 63 internal rules behind the families, and the API and CLI surfaces that manage it.

Fields

A rule set carries seven fields, four of which a request sets and three of which the platform sets and returns. The table below also lists the six nested fields inside engine_settings, so it runs to thirteen rows.

Three fields accept exactly one value each. rulesets accepts [1], engine_version accepts 2021-Q3, and engine_settings.type accepts score. Any other value returns 400 with 10039 Invalid Choice, so a request that carries a second ruleset ID or a later engine version is rejected rather than downgraded.

thresholds holds between 1 and 8 entries. A request that names fewer than eight families is accepted and stores exactly what it sent, and a request that names the same family twice returns 500 rather than a validation error. The Console form always writes all eight. A create that sends no engine_settings at all produces a complete rule set: ruleset [1], engine 2021-Q3, type score, and all eight families at medium.

Threat families

WAF scores a request against eight threat families. Each family carries its own sensitivity, so a request blocked for one family passes for another. The Console renders the eight as the Threat Type Configuration table on a rule set’s Main Settings tab.

Every family defaults to medium. Unwanted Access and Identified Attack are scored like the other six, and a create that sends no thresholds array carries all eight.

Sensitivity levels

A request carries one score per threat family that fired, and each score is compared with the threshold of its own family. The request is blocked when a score reaches that threshold.

The threshold falls as the sensitivity rises. A higher sensitivity therefore blocks more requests on less evidence, and a lower sensitivity lets more requests through: highest blocks at a score of 4, and lowest blocks at 40.

One sensitivity applies to one threat family, and each family is set independently. In the Console the option carries the word Sensitivity: the default option reads Sensitivity Medium.

Lowest and Low protect the application less and block fewer legitimate requests. High and Highest do the opposite, and they raise the number of false positives when the traffic already observed in Logging mode has not covered the variety of requests the application receives.

Internal rules

Each internal rule carries a numeric identifier, and a rule that fires contributes to the score of the threat family it belongs to. The identifier is what an exception names when it allows a pattern the rule would otherwise score. For more information, refer to WAF Exceptions.

Rule 0 means all rules, and an exception created against it applies to every other rule in the table.

The Console’s Rule ID dropdown offers 62 of these 63. Rule 1314 is absent from the list, and the API accepts it, so an exception for the back quote is created through the API or the CLI.

Some requests that fail rule 13 are blocked even when the rule set runs in Logging mode. For the request body size rule 2 measures, refer to Firewall limits.

API

Every operation is authenticated and sits under https://api.azion.com/v4/workspace/wafs. A request carries a token from Personal Tokens in the Authorization header under the Token scheme, and a request with a body also carries Content-Type: application/json.

A create, a clone, and a partial update answer 202, and the envelope carries a state of pending beside the object. A read answers 200 and carries data alone, with no state key.

Create a rule set

The response carries 202, and not 201:

The state of pending says the rule set was accepted, and the id in data is the handle every later call uses. last_editor carries the email of the account that last changed the rule set, and the value above is a placeholder. The response also carries version_id, version_state, is_versioned, and version, which a create body does not set. The API returns the thresholds sorted by threat, whatever order the request sent them in.

List rule sets

The response carries 200 and the collection envelope below, with one rule set per entry under results, each in the shape the create response carries.

The endpoint accepts fields, id, name, ordering, page, page_size, and search as query parameters. page_size runs from 1 to 100 and defaults to 10. A value above 100 returns 400 with 10097 Invalid Page Size.

Retrieve, update, and delete a rule set

GET /wafs/{waf_id} answers 200 and returns the rule set under data.

PUT /wafs/{waf_id} replaces a rule set and takes the same body as a create. PATCH /wafs/{waf_id} takes only the fields sent and answers 202 with a state of pending. A PATCH that carries engine_settings replaces the whole thresholds array rather than merging it entry by entry, so a partial update sends every threat family the rule set is to keep.

DELETE /wafs/{waf_id} removes a rule set and answers 202 with a state of pending. While a rule’s Set WAF behavior still applies the rule set, the delete is refused with 26007.

Clone a rule set

A clone is a deep copy of an existing rule set, including its exceptions.

The response carries 202, a state of pending, and the new rule set: a new id, the name the request sent, and the threat families and sensitivities copied from the source. The API adds no suffix and derives no name of its own.

The body is required, and so is the name inside it. A clone sent with no body, or with an empty object, returns 400:

CLI

The Azion CLI manages rule sets under the waf noun. The flags below are the ones Azion CLI 4.23.0 carries, without the global flags every command takes.

azion create waf and azion update waf share their flags, except that --product-version belongs to the create and --waf-id to the update.

azion list waf takes --details, --filter to filter by name, --order-by, --page with a default of 1, and --page-size with a default of 50. azion describe waf and azion delete waf each take --waf-id.

A create that sets every threat family takes one --thresholds value:

A create that sets nothing but a name produces a complete rule set:

azion describe waf --waf-id 12347 --format json returns the stored rule set, with the keys sorted by the CLI:

Errors

A rejected request returns an errors array. Each entry carries a code, a title, a detail, the status, and a source pointer naming the field the rejection is about:

10067 returns 500 for a client mistake. A repeated threat family is answered with the text A server error occurred., which names neither the duplicate nor the field, so a reader who trusts the status code concludes the platform is down, and a retry returns the same 500. Its source pointer reads /data/attributes/thresholds, one segment short of the pointer every other threshold error returns.

26007 names each rule that still applies the rule set twice, as <firewall-name> - <rule-name>: once in the detail, It was not possible to perform this operation. To delete this WAF, you must first remove its usage in the following rules engine: ['<firewall-name> - <rule-name>']., and once as an entry of meta.ef_rules_using_waf. Its source pointer reads /data.

Related resources