Does WAF custom rules support "matchVariableName": "jsonRequest"?

I'm getting some WAF blocking related to Microsoft_DefaultRuleSet-2.0-BLOCKING-EVALUATION-949110. When I follow the trackingreference i got this in details_matches_s:

I want to create a custom rule to except this kind of request. What kind of parameters should I select in Match variable selector?

KapilAnanth-MSFT 41,491 Reputation points Microsoft Employee

2022-10-06T14:03:25.057+00:00

Hi @Miguel Alfredo Cuba Cardozo ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are configuring Custom Rules in WAF to exclude certain requests.

I believe you are aware of the Rule 949110

So I would recommend you to check what are the other rules that are getting triggered and resulting in this anomaly score hit

Now, with your case, I believe you can try using QueryString or RequestBody depending upon the variable location.
Please give it a try and let me know if that helps.

Cheers,
Kapil
KapilAnanth-MSFT 41,491 Reputation points Microsoft Employee

2022-10-07T11:37:30.74+00:00
Hi @Miguel Alfredo Cuba Cardozo ,

You can consider tuning the WAF according to the best practices.

Refer : https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-tuning?pivots=front-door-standard-premium

If these requests are going to originate for a particular URI path, then you can create custom rules and allow them.
Using Custom Rules

Method#1

Using,

String as Match Type, Request Body as match Variable, use a "contains" operator to match jsonRequest.

AND

String as Match Type, Request URI as match Variable, use a "contains" operator to match this path.

Method#2

You can also use Exclusions as,

Match Variable as RequestBodyPostArgsNames, Operator as Contains and Selector as jsonRequest

Refer : Using exclusion lists

Please let us know if any of the above works.

Cheers,
Kapil
Miguel Alfredo Cuba Cardozo 1 Reputation point

2022-10-11T15:14:40.85+00:00

I will check this information.
Thanks!
KapilAnanth-MSFT 41,491 Reputation points Microsoft Employee

2022-10-12T13:41:50.633+00:00

Hi @Miguel Alfredo Cuba Cardozo ,

Sure.

You can test this setup and update if this works for you.

Cheers,
Kapil

Share via

Does WAF custom rules support "matchVariableName": "jsonRequest"?