F5 Rules for AWS WAF - does F5 have any access to the request data inspected by the rule groups?
I'm reviewing the data handling characteristics of the F5 Rules for AWS WAF managed rule groups (purchased through AWS Marketplace) and would like to confirm my understanding with the community. K21015971 describes the procedure for reporting a suspected false positive. As I read it, the customer is asked to log the blocked HTTP requests along with the names of the rules that matched, mask any sensitive information with ****, and then submit a question with the F5 rules for AWS WAF tag and attach those requests. My reading of that procedure is that F5 has no independent access to the requests inspected by the rule groups. If F5 could see them, there would be no need for the customer to extract, mask and attach them manually. Is that reading correct? More specifically, could someone confirm whether the following are accurate? 1. HTTP request data inspected by the rule groups (source IP addresses, headers, request bodies, query strings, cookies) is never transmitted to F5. 2. AWS WAF logs, sampled requests, CloudWatch metrics, and the labels generated by rule matches remain entirely within the subscriber's own AWS account, with no access path available to F5. 3. The only information F5 receives in connection with a subscription is AWS Marketplace billing and metering data. One related question. Section 5 of the F5 End User License Agreement (Collection and Use of Product Information) notes that, depending on the product and the licensed pricing tier, a customer may be able to opt out of the collection and use of such information by configuring the product to disable those features. Is there any such configuration available for these rule groups? Or does the question simply not arise because no collection takes place for this product? Thanks in advance.
F5 rules for AWS WAF compatibility with the new WAF console
Once subscribed to the F5 rules for AWS WAF, I was redirected to the old/classic WAF console that we are not using, and I can't seem to find F5 rules in the new AWS WAF console. Is it not supported? Is there a plan / timeline to make it usable in the new console?
AWS F5_OWASP Managed Rule Blocking requests
AWS F5 OWASP managed rules are blocking requests all of a sudden (23-01-2025) We want to understand if there was any update made and also the changelog for this update and which rules were updated. Where do I find this information and AWS is not supporting these rules since these are managed by F5. Do we have a way to reach the vendor ?
Add all rule labels to events in F5 Rules for AWS WAF - Web exploits OWASP Rules
Hi all, We're subscribed to the "F5 Rules for AWS WAF - Web exploits OWASP Rules" rules for AWS WAF via Marketplace, and we're looking at the labels that are added to events passing through the WAF. Currently we see only a single label added to all the events, regardless of which rule triggered a match, the label is: "labels": [ { "name": "awswaf:managed:f5:web-exploits-owasp-rules:OWASP4" } ], Is there any way to also see the specific rule that triggered, for example the `ruleId`, which we can see in the logs is `rule_Union_Based_AllQueryArguments_Body`. "terminatingRule": { "ruleId": "rule_Union_Based_AllQueryArguments_Body", "action": "BLOCK", "ruleMatchDetails": null }, This would allow us to better handle false positives for specific rules, without disabling the entire thing. Does anyone have any ideas? Thanks
F5-OWASP_Managed (rule_General_Protection_AllQueryArguments_Body)
Hello All, We experienced unexpected blocking of legitimate traffic in our WAF that significantly impacted our services. And we found the reason is { "timestamp": 1752430193632, "formatVersion": 1, "webaclId": "arn:aws:wafv2:me-central-1:1047******:regional/webacl/******-*****-waf/67d0d073-8a81-4**f-9f48-8******c2d15", "terminatingRuleId": "F5-OWASP_Managed", "terminatingRuleType": "MANAGED_RULE_GROUP", "action": "BLOCK", "terminatingRuleMatchDetails": [ { "conditionType": "REGEX", "location": "BODY", "matchedData": null, "matchedFieldName": "" } And the rule that did that is { "ruleGroupId": "F5#OWASP_Managed", "terminatingRule": { "ruleId": "rule_General_Protection_AllQueryArguments_Body", "action": "BLOCK", "ruleMatchDetails": null }, We didn't change anything for the application side, also it was working well for more than a month. Is there any update happened yesterday (13/7/2025) on regex for F5-OWASP_Managed (rule_General_Protection_AllQueryArguments_Body)
Urgent - WAF Rules Not Allowing Connection
We are experiencing issues related to the F5 OWASP Managed WAF Rules, users are getting 403 forbidden error messages. The CloudWatch metrics show a spike starting on 07/13. {"ruleGroupId":"F5#OWASP_Managed","terminatingRule":{"ruleId":"rule_General_Protection_AllQueryArguments_Body","action":"BLOCK","ruleMatchDetails":null
AWS WAF Rule F5-OWASP_Managed custom response
Hi! We are using AWS WAF managed rule 'F5-OWASP_Managed'. I would like to create a WAF custom response when requests are blocked by this rule. To do so I need to change the rule from block to count, and capture labels assigned by this rule in a WAF custom rule. When looking into the AWS WAF console I cannot see any labels assigned to this WAF rule? Can somebody please tell me if this rule assigns labels, and, which one? ThanksF5 x-chunk
sorry for the simplicity in this but i keep getting a 'http request body unparsed payload'. it's a user file upload. multiple types, pdf zip txt. theres no content type in the post and i tried a do nothing for multipart/form-data under the uri. there's nothing that should be conflicting w it. the xchunk is identifying the file type uploaded but theres not much to go off of. i just have a list of individual attack sigs to tune for on the user end. kinda lost. any help is appreciated TIA