Action Plan WAF azure Detection Mode to Prevention Mode

Question

Hello ,

i have a project to shift from Azure WAF Detection mode to Prevention mode .
My question : what i should plan before do this shift because some impacts maybe will be happen after this .

Regards

Answer 1

Hi,

I will suggest you to review the firewall logs and check all the app ports are open and allowed access as per the requirements, also you will need to setup custom and any exceptions before you change it to Prevention mode. This can help reduce the occurrence of unexpected blocked traffic.

I will suggest you to carry out this change out of hours and over weekend to reduce the impact to live users, this is as per personal experience.

---

Please don't forget to upvote and Accept as answer if the reply is helpful

If this answer helped you please mark it as "Verified" so other users can reference it.

Answer 2

could you help to follow any video or document or any support to help me ?

Thanks

Answer 3

Hello @Azuriste Azuriste

In addition to @JimmySalian-2011

Read the Docs

https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/best-practices

Review your existing WAF rules and configurations:

Take a look at your existing WAF policies and ensure they are up-to-date and optimized for the latest threats. Consider disabling any rules that are not being used or are not applicable to your application.

Plan the migration:

Create a detailed migration plan that outlines the steps involved in switching from detection to prevention mode. This plan should include a timeline, testing procedures, and a rollback plan.

Test the migration:

Before moving to prevention mode, conduct thorough testing of your application to ensure that the WAF policies are working as expected. Test various scenarios to identify any potential issues that may arise.

Monitor the application after the migration:

After the migration, monitor your application's performance closely to identify any issues that may arise. Set up monitoring tools to keep an eye on application performance, traffic patterns, and potential attacks.

Train your team:

Provide training to your team members on the new prevention mode and its features. Make sure they understand how to configure and manage the new policies, and how to identify and respond to potential attacks.

Have a rollback plan:

In case of any issues, have a well-defined rollback plan to switch back to detection mode.

I hope this helps!

---

The answer or portions of it may have been assisted by AI Source: ChatGPT Subscription

Kindly mark the answer as Accepted and Upvote in case it helped or post your feedback to help !

Regards