For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

MSZall's avatar
MSZall
Icon for Nimbostratus rankNimbostratus
Jul 22, 2025

How does OWASP ModSecurity Core Rule Set (CRS) relate to F5 AWAF?

Hi I have a question how does OWASP ModSecurity Core Rule Set (CRS) relate to F5 AWAF. Does F5 AWAF support OWASP ModSecurity Core Rule Set (CRS) or does it have something of its own and better? 
security
Injeyan_Kostas's avatar
Injeyan_Kostas
Icon for Nacreous rankNacreous
Jul 22, 2025

Hi MSZall​ 
F5 uses its own proprietary engine and custom-built security rules instead of the OWASP ModSecurity Core Rule Set (CRS). Since F5 is a leader in the WAF space, its solution is generally more advanced and effective than ModSecurity with CRS, especially for enterprise use cases.

MSZall's avatar
MSZall
Icon for Nimbostratus rankNimbostratus
Jul 23, 2025

Thanks a lot.