Advanced WAF

The Advanced WAF starts with a broad and restrictive block list, on top of which application-specific lists of allowed patterns (for example, ignoring certain URLs) must be applied to fix false positives.

The deployment begins in learning mode, which is a log-only mode. Learning here meaning you have time to inspect your logs and learn which false positives need to be fixed. In learning mode, the Advanced WAF:

• permits all traffic and blocks no requests.

• inspects incoming requests and logs those that match a violation pattern. If there is a false positive, you can add it to the allowlist.

When you switch to blocking mode, requests not in the allowlist that violate the current ruleset will be blocked. Logs remain available for further monitoring and identification of cases that should be marked as allowed.

Install the Advanced WAF

Install the Advanced WAF

Rule Customization

Customize the Advanced WAF rules

Enable Advanced WAF logs

Enable logs for the Advanced WAF

Synchronize WAF rules

Share updates to rules files across HAProxy Enterprise nodes

Track triggered rules

Track triggered rules

WAF filter parameters

WAF filter parameters Reference

Next up