The Advanced WAF starts with a very broad and restrictive block list, on top of which application-specific lists of allowed patterns (i.e. ignoring certain URLs) must be applied to fix false positives.
The deployment begins in learning mode, which is a log-only mode. Learning here meaning you have time to inspect your logs and learn which false positives need to be fixed. In learning mode, the Advanced WAF:
permits all traffic and blocks no requests.
inspects incoming requests and logs those that match a violation pattern; If there is a false positive, you can add it to the allowlist.
When you switch to blocking mode, requests not in the allowlist that violate the current ruleset will be blocked. Logs remain available for further monitoring and identification of cases that should be marked as allowed.
Choose from the following topics:
- Install the Advanced WAF
Install the Advanced WAF
- Rule Customization
Customize the Advanced WAF rules
- Enable Advanced WAF logs
Enable logs for the Advanced WAF
- Synchronize WAF rules
Share updates to rules files across HAProxy Enterprise nodes
- Track triggered rules
Track triggered rules
- WAF filter parameters
WAF filter parameters Reference
Next upInstall the Advanced WAF