Where can I find the severity level of OWASP 3.2 Rules?

Question

Azure anomaly scoring documentation refers to severity levels for specific OWASP rules to determine whether the WAF will actually block the traffic or not. However I have been unable to find specific severity levels for specific rules either in our Azure environment or online. Can someone point me in the right direction?

Answer 1

@Derosier, Conner R ,

Welcome to the Microsoft Q&A forum.

You can find the severity levels for individual OWASP 3.2 Rules listed in the corerulesets repository. For example REQUEST-911-METHOD-ENFORCEMENT rule has a severity Critical.

Hope this answers your question. Please let me know if you have any additional questions. Thank you!