WAF examples

Copy a ready-to-use snippet for a WAF rule set, the rule that applies it, an exception, and the query that reads a block.

Last updated

View as Markdown Agent setup

Copy any of these snippets and change the names and ids for your own account. Each one is the smallest complete form of a task the rest of the Web Application Firewall (WAF) documentation describes at length: a rule set, the Rules Engine rule that applies it, the exception that clears a false positive, and the query that returns what WAF decided about a request.

A rule set scores nothing on its own. Until a Rules Engine rule on a firewall carries a Set WAF behavior naming it, no request is scored, so the first two snippets belong together. Where a snippet has both an API and an Azion CLI form, the page carries both.

A rule set in the request path

A rule set at medium sensitivity

Create a rule set carrying the eight threat families at the sensitivity level every family starts on.

A rule that applies a rule set

Build the Rules Engine rule whose Set WAF behavior puts a rule set in front of every request a firewall receives.

Bind a rule set in azion.config.js

Declare the rule set and the firewall rule that applies it in the configuration file, instead of creating both by hand.

What a rule set blocks

Switch a rule set to blocking

Change the mode on the behavior that applies a rule set, so a scored request is refused rather than served.

Raise one threat family

Set a higher sensitivity on one threat family and keep the other seven where they are.

A block and its exception

Read the score of a blocked request

Query Real-Time Events for the internal rules that matched a request and the score each threat family gave it.

Exempt one query string parameter

Stop one internal rule firing on one named query string argument, and leave it firing everywhere else.

Exempt one request header

Name a single header in an exception, and avoid the condition shape that silently covers every header.

WAF quickstart

Run these snippets in order, from an empty account to a request that is refused.

Scoring and modes

The path a request travels, the scoring model, and what each mode does.

WAF Rule Sets

Every field a rule set carries, its eight threat families, and the internal rules behind them.

WAF Exceptions

Every field an exception carries and the fifteen match values a condition takes.

Firewall best practices

What each of these snippets costs in production, and the order to apply them in.

Troubleshoot Firewall

What to read when a snippet runs and the result is not what you expected.