WAF Custom Rules allow you to define specific conditions and actions to inspect and control incoming web traffic. They provide fine-grained protection tailored to your application’s specific requirements, extending the protection provided by the Managed WAF.
Custom Rules can also be used to influence the behavior of the Managed WAF.
You can create rules based on attributes such as IP addresses and other network parameters, headers, cookies, query parameters, request body content, and more.
Custom Rules can be used to:
- Block malicious traffic.
- Enforce application-specific business logic.
- Mitigate attacks that are unique to your application.
- Allow specific traffic that would otherwise be considered a threat.
This flexibility allows you to define security policies that closely match your application’s requirements.
Order of Execution #
Custom Rules are executed in their defined order. If a request matches a Custom Rule condition, the corresponding action is applied.
The following actions are available:
| Action | Subsequent Rules | Rate Limit | Managed WAF | Effect |
| Block | Ignore | Ignore | Action ignored | Block the request |
| Challenge | Evaluate | Evaluate | Run | Verify that the client is human |
| Bypass Managed | Evaluate | Evaluate | Learn (don’t prevent) | Prevent the Managed WAF from blocking the request |
| Ignore | Evaluate | Evaluate | Run | Instruct the WAF to ignore a specific JSON parameter in the request body or an identified indicator |
| Log | Evaluate | Evaluate | Run | Add the request to the sampled log |
| Allow | Ignore | Ignore | Action ignored | Allow the request |
If the action is a terminating action (Allow or Block):
- Subsequent Custom Rules will not be executed.
- Rate Limit rules will not be executed.
- The Managed WAF will still be executed, but its resulting action will be ignored.
If the action is Log or Bypass, subsequent rules will continue to execute in their defined order.
Adding a Custom Rule #
You can configure multiple Custom Rules within a service. Each rule consists of a condition and an action to apply when a request matches that condition.
To add a Custom Rule to your service:
- Navigate to your service.
- In the sidebar, select Security, then select WAF.
- Click the Create button.
- Complete the new Custom Rule form:
- Rule Name – Enter a name for the new rule.
- Condition – Define the condition that determines which requests the rule applies to. You can create complex conditions using
ORandANDoperators. - Action – Select the action to apply to requests that match the condition.
5. Click Save.
Updating & Deleting a Custom Rule #
To modify or delete a Custom Rule in your service:
- Navigate to your service.
- In the sidebar, select Security, then select WAF.
- Find the Custom Rule you want to modify or delete.
- Click the Edit icon to modify the rule, or the Delete icon to remove it.