Question

A retail company runs a public web application behind a global external Application Load Balancer, protected by a Cloud Armor security policy. The security team enables the preconfigured SQL injection (sqli-v33-stable) WAF rule at its default sensitivity. Immediately, legitimate users report that they can no longer submit product reviews containing text like "O'Brien's shop is great", and logs show these requests are being blocked by the sqli rule. The team must keep strong SQLi protection but stop blocking valid review submissions. What is the most appropriate action?

Accepted Answer

Lower the preconfigured sqli rule sensitivity level and/or exclude the specific request field (the review body) from inspection using the rule's opt-out expression, then retest.

Answer

Delete the sqli-v33-stable rule entirely and rely on Adaptive Protection to detect any injection attempts automatically.

Answer

Add a higher-priority allow rule that matches all requests to the review submission URL path, bypassing WAF evaluation for that path.

Answer

Switch the security policy to preview (dry-run) mode so the sqli rule logs matches but never blocks any traffic.