Question

Your company runs a public web application behind an Azure Application Gateway v2 with an associated WAF policy currently using OWASP Core Rule Set (CRS) 3.1 in Prevention mode. After a security audit, you are directed to protect against the latest known attack signatures, including newer Java-based exploits, while keeping the ability to disable individual rules that cause false positives. What should you do?

Accepted Answer

Upgrade the WAF policy to the Microsoft Default Rule Set (DRS) 2.1, which includes the Microsoft Threat Intelligence Collection, and keep Prevention mode.

Answer

Switch the WAF policy from Prevention mode to Detection mode so that all traffic is logged and newer signatures are captured.

Answer

Create a custom rule that blocks all inbound traffic containing Java class references and add it to the existing CRS 3.1 policy.

Answer

Migrate the application behind Azure Front Door and apply the Front Door DRS, since Application Gateway cannot use rule sets newer than CRS 3.1.