azure-waf

Name: azure-waf
Author: vinayaklatthe

161stars34forks

How to install azure-waf?

vinayaklatthe/microsoft-security-skills/azure-waf

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-waf

Installs into the current project.

Summary

Guidance for Azure Web Application Firewall — deployed on Azure Front Door (global, edge-tier) or Azure Application Gateway (regional, integrated with backend pools). Covers WAF policy design with managed rule sets (Microsoft Default Rule Set, Bot Manager, OWASP CRS), custom rule

Files · 1

View on GitHub

SKILL.md

1	# Azure Web Application Firewall (WAF)
2
3	Azure WAF is an OWASP-aligned application-layer firewall available in two host services:
4
5	- Azure Front Door (Premium / Standard) — global, anycast, edge-tier, ideal for
6	internet-facing apps and APIs that benefit from edge presence and built-in caching.
7	- Azure Application Gateway (WAF v2) — regional, integrated with backend pools, ideal
8	for app-internal or VNet-bound workloads that already terminate on App Gateway.
9
10	## When to use
11	Protecting public web applications and APIs from layer-7 attacks: SQLi, XSS, RCE
12	patterns, automated scanners, credential stuffing, scraping, and bot abuse. Use this
13	skill for host selection, policy authoring, exclusion tuning, and operational ownership.
14
15	Do not use this skill for layer 3/4 DDoS (`azure-ddos-protection`), east-west /
16	non-HTTP traffic (`azure-firewall`), or non-HTTP protocols.
17
18	## Pick the host
19
20	\| Host \| Best for \|
21	\|---\|---\|
22	\| Front Door Premium WAF \| Internet apps/APIs needing global edge, advanced bot manager, JS/JSON challenges, private-link backends \|
23	\| Front Door Standard WAF \| Cost-sensitive internet apps with managed Default Rule Set + custom rules \|
24	\| App Gateway WAF v2 \| Regional apps already on App Gateway, VNet-internal apps, bring-your-own-cert/zonal needs \|
25
26	> Rule of thumb: Internet-facing new build → Front Door Premium. Brownfield with
27	> existing App Gateway + sticky reasons → App Gateway WAF.
28
29	## Approach
30
31	1. Start in Detection (audit) mode. Always. Two minimum weeks of production traffic
32	(more for seasonal apps) before flipping to Prevention.
33
34	2. Apply Microsoft's Default Rule Set (DRS). Current generation is preferred over
35	the older OWASP CRS for new deployments. Enable Bot Manager rule set on Premium for
36	Front Door.
37
38	3. Authentication-aware rules first.
39	- Rate limit anonymous endpoints (login, search, signup) — typical 100/min/IP for
40	login.
41	- Geo-block countries you don't serve, but allowlist VPN concentrators or
42	partner regions.
43	- JSON / JS challenge on suspicious bot scores (Premium) — silently filters
44	headless browsers.
45
46	4. Tune exclusions iteratively. This is the core operational task and the reason
47	most WAFs end up "in detection forever." Process:
48	1. Pull Detection-mode hits from `AzureDiagnostics` / `AGCWAFLogs`.
49	2. Group by rule ID + URI + parameter.
50	3. Confirm legitimate traffic (e.g., a legit SOAP body with `<` characters, an API
51	that legitimately includes SQL keywords).
52	4. Add scoped exclusion for that rule on that URI/parameter — never disable the
53	whole rule globally.
54	5. Re-baseline weekly.
55
56	5. Promote to Prevention rule by rule, not all at once. Start with high-confidence,
57	low-FP rules (RCE patterns, command injection). Hold off on chatty rules (XSS,
58	protocol violations) until exclusions are stable.
59
60	6. Custom rules for business logic. Examples:
61	- Block specific user agents in pen-test campaigns.
62	- Allow a partner CIDR to bypass rate limits.
63	- Require a specific header on internal APIs.
64	- Geo-block all but expected countries for admin paths.
65
66	7. Logging & analytics. Send WAF logs to Log Analytics (and Sentinel). Build:
67	- Top blocked rules + top false-positive candidates (work queue).
68	- Geo distribution of blocked traffic.
69	- Rate-limit hits per endpoint.
70	- Bot manager classification trends.
71
72	8. Operational ownership. WAF without a named app-team owner regresses. Monthly:
73	- Review new rule set updates from Microsoft (auto-applied by default; review log
74	diffs).
75	- Re-baseline exclusions after app deployments that change request shapes.
76	- Validate Prevention coverage (no quietly-disabled rules).
77
78	9. Pair with DDoS Protection on the front-door public IP / App Gateway public IP.
79	WAF is L7; DDoS is L3/4. Both, always, for high-value public workloads.
80
81	## Guardrai

People who liked this also viewed

6 picks

Type

azure-waf

161stars34forks

View on GitHub

How to install azure-waf?

vinayaklatthe/microsoft-security-skills/azure-waf

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-waf

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Azure Web Application Firewall (WAF)
2
3	Azure WAF is an OWASP-aligned application-layer firewall available in two host services:
4
5	- Azure Front Door (Premium / Standard) — global, anycast, edge-tier, ideal for
6	internet-facing apps and APIs that benefit from edge presence and built-in caching.
7	- Azure Application Gateway (WAF v2) — regional, integrated with backend pools, ideal
8	for app-internal or VNet-bound workloads that already terminate on App Gateway.
9
10	## When to use
11	Protecting public web applications and APIs from layer-7 attacks: SQLi, XSS, RCE
12	patterns, automated scanners, credential stuffing, scraping, and bot abuse. Use this
13	skill for host selection, policy authoring, exclusion tuning, and operational ownership.
14
15	Do not use this skill for layer 3/4 DDoS (`azure-ddos-protection`), east-west /
16	non-HTTP traffic (`azure-firewall`), or non-HTTP protocols.
17
18	## Pick the host
19
20	\| Host \| Best for \|
21	\|---\|---\|
22	\| Front Door Premium WAF \| Internet apps/APIs needing global edge, advanced bot manager, JS/JSON challenges, private-link backends \|
23	\| Front Door Standard WAF \| Cost-sensitive internet apps with managed Default Rule Set + custom rules \|
24	\| App Gateway WAF v2 \| Regional apps already on App Gateway, VNet-internal apps, bring-your-own-cert/zonal needs \|
25
26	> Rule of thumb: Internet-facing new build → Front Door Premium. Brownfield with
27	> existing App Gateway + sticky reasons → App Gateway WAF.
28
29	## Approach
30
31	1. Start in Detection (audit) mode. Always. Two minimum weeks of production traffic
32	(more for seasonal apps) before flipping to Prevention.
33
34	2. Apply Microsoft's Default Rule Set (DRS). Current generation is preferred over
35	the older OWASP CRS for new deployments. Enable Bot Manager rule set on Premium for
36	Front Door.
37
38	3. Authentication-aware rules first.
39	- Rate limit anonymous endpoints (login, search, signup) — typical 100/min/IP for
40	login.
41	- Geo-block countries you don't serve, but allowlist VPN concentrators or
42	partner regions.
43	- JSON / JS challenge on suspicious bot scores (Premium) — silently filters
44	headless browsers.
45
46	4. Tune exclusions iteratively. This is the core operational task and the reason
47	most WAFs end up "in detection forever." Process:
48	1. Pull Detection-mode hits from `AzureDiagnostics` / `AGCWAFLogs`.
49	2. Group by rule ID + URI + parameter.
50	3. Confirm legitimate traffic (e.g., a legit SOAP body with `<` characters, an API
51	that legitimately includes SQL keywords).
52	4. Add scoped exclusion for that rule on that URI/parameter — never disable the
53	whole rule globally.
54	5. Re-baseline weekly.
55
56	5. Promote to Prevention rule by rule, not all at once. Start with high-confidence,
57	low-FP rules (RCE patterns, command injection). Hold off on chatty rules (XSS,
58	protocol violations) until exclusions are stable.
59
60	6. Custom rules for business logic. Examples:
61	- Block specific user agents in pen-test campaigns.
62	- Allow a partner CIDR to bypass rate limits.
63	- Require a specific header on internal APIs.
64	- Geo-block all but expected countries for admin paths.
65
66	7. Logging & analytics. Send WAF logs to Log Analytics (and Sentinel). Build:
67	- Top blocked rules + top false-positive candidates (work queue).
68	- Geo distribution of blocked traffic.
69	- Rate-limit hits per endpoint.
70	- Bot manager classification trends.
71
72	8. Operational ownership. WAF without a named app-team owner regresses. Monthly:
73	- Review new rule set updates from Microsoft (auto-applied by default; review log
74	diffs).
75	- Re-baseline exclusions after app deployments that change request shapes.
76	- Validate Prevention coverage (no quietly-disabled rules).
77
78	9. Pair with DDoS Protection on the front-door public IP / App Gateway public IP.
79	WAF is L7; DDoS is L3/4. Both, always, for high-value public workloads.
80
81	## Guardrai

People who liked this also viewed

6 picks

Type