Forum Discussion

omarahmed3797's avatar
omarahmed3797
Icon for Nimbostratus rankNimbostratus
Jul 14, 2025

F5-OWASP_Managed (rule_General_Protection_AllQueryArguments_Body)

Hello All,

We experienced unexpected blocking of legitimate traffic in our WAF that significantly impacted our services.

And we found the reason is 

 

 

{
  "timestamp": 1752430193632,
  "formatVersion": 1,
  "webaclId": "arn:aws:wafv2:me-central-1:1047******:regional/webacl/******-*****-waf/67d0d073-8a81-4**f-9f48-8******c2d15",
  "terminatingRuleId": "F5-OWASP_Managed",
  "terminatingRuleType": "MANAGED_RULE_GROUP",
  "action": "BLOCK",
  "terminatingRuleMatchDetails": [
    {
      "conditionType": "REGEX",
      "location": "BODY",
      "matchedData": null,
      "matchedFieldName": ""
    }

And the rule that did that is

{
      "ruleGroupId": "F5#OWASP_Managed",
      "terminatingRule": {
        "ruleId": "rule_General_Protection_AllQueryArguments_Body",
        "action": "BLOCK",
        "ruleMatchDetails": null
      },


We didn't change anything for the application side, also it was working well for more than a month.


Is there any update happened yesterday (13/7/2025) on regex for F5-OWASP_Managed (rule_General_Protection_AllQueryArguments_Body) 

2 Replies

  • VGF5's avatar
    VGF5
    Icon for Cumulonimbus rankCumulonimbus

    It appears that the system automatically updates its rules, and no customer action is necessary or feasible to control the timing or content of these updates.

    Check the following article :

    K21015971: Overview of F5 rule groups for AWS WAF

    Open ticket with F5 and get the more details.

  • F5 OWASP Managed WAF Rules went through a rule update on Sunday, July 13th, which affected some customers and blocked legitimate traffic.
    We have since fixed the issue. The false positives should no longer occur as of Tuesday, July 15th.
    We apologize for the disruption to service