Does it worth using WAF policies?

JMN-2253 596

I am working with a big customer.

We are deploying AG + WAF.

The amount of reported blocked requests are not normal.

Customer is surprised as his code is not really bad.

Do we know any tool MS or 3rd party to inspect their websites to proof that WAF is doing his job, and the websites codes are bad?

KapilAnanth-MSFT 44,466 Reputation points Microsoft Employee

2022-09-12T09:13:19.817+00:00

Hi @JanNuaman-2253 ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are looking for a tool to double verify the WAF results.

Currently, there is no specific tool to check the above.
The WAF rules are based on OWASP Rules (open source), so you can cross verify them using the rule definitions.

Please do let me know should you have any questions, I shall try to address them.

Cheers,
Kapil

Accepted answer

David Broggy 5,716 Reputation points MVP

2022-09-08T21:25:43.463+00:00

Hi Jan!

afaik Microsoft does not have a web application testing tool.

I work for a company that offers that service, so if there was a Microsoft 'professional' tool we'd probably be using it.

If you google/Bing "web application testing tool free" you'll get plenty of hits.

Microsoft's WAF is based on Mod_Security - it can generate a lot of false positives, and it does have a learning curve if you want to really understand it.

WAF is the way to go if you need surgical blocking at the DOM level.

But don't expect WAF to work well unless you understand exactly what the enabled rules are doing. (respectfully speaking!)
Please sign in to rate this answer.
JMN-2253 596 Reputation points

2022-09-08T22:22:16.883+00:00

I understand what each rule does, Log Analytics show me what WAF doesn't like and why it consider content as false unsafe. The problem is proofing the same using more friendly tool.

Anyway, thank you for your opinion.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

0 additional answers

Your answer