The Advanced WAF starts with a very broad and restrictive block list, on top of which application-specific lists of allowed patterns (i.e. ignoring certain URLs) must be applied to fix false positives.
The deployment begins in learning mode, which is a log-only mode. Learning here meaning you have time to inspect your logs and learn which false positives need to be fixed. In learning mode, the Advanced WAF:
permits all traffic and blocks no requests.
inspects incoming requests and logs those that match a violation pattern; If there is a false positive, you can add it to the allowlist.
When you switch to blocking mode, requests not in the allowlist that violate the current ruleset will be blocked. Logs remain available for further monitoring and identification of cases that should be marked as allowed.
Choose from the following topics:
Install the Advanced WAF
- Rule Customization
Customize the Advanced WAF rules
- Server Synchronization
Share updates to rule files across HAProxy Enterprise instances
- WAF Logs
Understand the WAF log format
- Track Triggered Rules
Track triggered rules
- Custom Core Rules
Load a built-in custom rule set
- WAF Filter Parameters
WAF filter parameters Reference
Next upAdvanced WAF Installation