How to understand which rules are BLOCKING-EVALUATION-949110?

Question

How to understand which rules are BLOCKING-EVALUATION-949110? Or which content of my application data is blocking me with this rules?

Answer 1

Hi @Deepaklal-FT

As per MS DOC, WAF RULE ID 949110 may appear when reviewing your WAF logs. The rule description might include 'Inbound Anomaly Score Exceeded'

You can use the Kusto query below to find the detailed reason by examining the Message, DetailedMessage, and FileDetails fields for the blocked rule ID 949110. These fields help pinpoint which part of the request was flagged

AGWFirewallLogs

Output:

To check the detailed reason for the rule ID 949110 block and find the specific rules that contributed to the score, run the following KQL query in your Log Analytics Workspace.

Note: Copy the TransactionId from the result above and replace it in the KQL query below.

AGWFirewallLogs
| where TransactionId == "6688fa7d46942f5f8beb9c51a091d5cc"
| where RuleId != 949110
| project TimeGenerated, RuleId, Message, Action, RuleSetType, RuleSetVersion, FileDetails

Output:

This will list all the individual rules (e.g., SQLi, XSS) that were triggered and contributed to the total score of 71—each rule typically adds 5, 10, or 20 points.

The final reason rule ID 949110 was triggered is that your request violated multiple OWASP CRS rules. Each rule adds an 'anomaly score' (typically 5, 10, or 20), and in this case, the cumulative score reached 71(in mycase), which is well above the default blocking threshold of 5.

A mix of XSS + SQL Injection + host header issues resulted in a high anomaly score. Since the WAF is in Prevention mode, the summary rule 949110 blocks the request

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.