Forum Discussion

tboemker's avatar
tboemker
Icon for Nimbostratus rankNimbostratus
Jan 07, 2022

Impact of adding new rules in Block mode

When new rules are added to a managed rule set, they are added in Block mode. In a production environment, that could cause legitimate traffic to start being blocked.   How are customers supposed...
cloud
F5 Rules for AWS WAF
security
Nikoolayy1's avatar
Nikoolayy1
Icon for MVP rankMVP
Jan 26, 2022

The AWS WAF is basically linux modsecurity so no matter if you use the F5 rules or AWS ones this are the AWS WAF limitations as there is no machine learning or new rules or modified being placed in learning mode  like the F5 signatures.

 

The only option I can suggest is to use AWS waf version managment and to change the "default" setting to a specific version and each week to manially check for a new version and if there is a new version to select it and then to test in a test window. you my try to automate this in some way.

 

https://docs.aws.amazon.com/waf/latest/developerguide/waf-managed-rule-groups-versioning.html