Question

Your company deployed an Azure Application Gateway v2 with an associated WAF policy running the OWASP Core Rule Set. The policy has been operating in Detection mode for two weeks. After reviewing the WAF logs, the security team confirms that legitimate application traffic is not triggering false positives and wants the WAF to begin actively blocking malicious requests that match rule set signatures. What should you do to meet this requirement with the least administrative effort?

Accepted Answer

Change the WAF policy mode from Detection to Prevention.

Answer

Create custom rules with a Block action for each OWASP rule that fired in the logs.

Answer

Disable the OWASP Core Rule Set and enable the Microsoft Default Rule Set in Detection mode.

Answer

Recreate the WAF policy and associate it in Prevention mode, since mode cannot be changed after creation.