F5 rules for AWS WAF

Hi, We are experiencing false positives with the WAF rule rule_ZmEu_Headers, part of the F5-Bots_Managed ruleset protecting our backend.

Issue details:

- Legitimate requests from our customers are being blocked with HTTP 403 Forbidden errors.

-The blocked requests include the standard AWS session stickiness cookies AWSALB and AWSALBCORS.

- These cookies contain values that coincidentally include the substring "ZMEU", which appears to be causing the rule to trigger incorrectly.

- We suspect the rule performs a basic substring match on header values leading to false positives.

- The requests otherwise come from valid user agents and normal browser traffic.

- This issue is impacting business operations and requires urgent attention.

Request:

- Please clarify the detection logic behind rule_ZmEu_Headers.

- Can the rule be tuned or exceptions created to avoid false positives caused by cookies?

- Is there a recommended best practice to exclude legitimate session cookies like AWSALB from this check?

- We would appreciate guidance on mitigating this issue without disabling the entire bot protection ruleset.

Please check the attached log for an example block.

Thanks.