Skip to content

Policy - Audit legacy or deprecated WAF rulesets on Application Gateway and Front Door #494

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
andrewmathuj wants to merge 6 commits into from
Closed

Policy - Audit legacy or deprecated WAF rulesets on Application Gateway and Front Door #494

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
34d9223
Create Policy - Audit legacy or deprecated WAF rulesets on Applicatio…
andrewmathuj Nov 6, 2025
64ecfa6
Delete Azure WAF/Policy - Azure Policy Definitions/Policy - Audit leg…
andrewmathuj Nov 6, 2025
901b43b
Create README.md
andrewmathuj Nov 7, 2025
239bbc9
Update README.md
andrewmathuj Nov 7, 2025
0450bab
Added JSON file with the audit policy
andrewmathuj Nov 7, 2025
8f141b2
Merge branch 'Azure:master' into master
andrewmathuj Nov 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
129 changes: 129 additions & 0 deletions ...t Door/Audit legacy or deprecated WAF rulesets on Application Gateway and Front Door.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,129 @@
{
"properties": {
"displayName": "Audit legacy or deprecated WAF rulesets on Application Gateway and Front Door",
"policyType": "Custom",
"mode": "All",
"description": "Audits Web Application Firewall policies that use legacy or deprecated OWASP or DRS rulesets. OWASP CRS 3.0 and 2.2.9 are deprecated; OWASP 3.1 and 3.2 are legacy. DRS 1.1 and 1.0 are legacy. Also flags Front Door Standard WAF policies with no managed rules.",
"metadata": {
"category": "Network",
"version": "1.0.0"
},
"parameters": {
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "The effect determines what happens when the policy rule is evaluated to match"
},
"allowedValues": [
"Audit",
"Deny",
"Disabled"
],
"defaultValue": "Audit"
}
},
"policyRule": {
"if": {
"anyOf": [
{
"allOf": [
{
"field": "type",
"equals": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies"
},
{
"count": {
"field": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/managedRules.managedRuleSets[*]",
"where": {
"anyOf": [
{
"allOf": [
{
"field": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/managedRules.managedRuleSets[*].ruleSetType",
"equals": "OWASP"
},
{
"field": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/managedRules.managedRuleSets[*].ruleSetVersion",
"in": [
"3.2",
"3.1",
"3.0",
"2.2.9"
]
}
]
}
]
}
},
"greater": 0
}
]
},
{
"allOf": [
{
"field": "type",
"equals": "Microsoft.Network/frontdoorwebapplicationfirewallpolicies"
},
{
"anyOf": [
{
"allOf": [
{
"count": {
"field": "Microsoft.Network/frontdoorwebapplicationfirewallpolicies/managedRules.managedRuleSets[*]",
"where": {
"allOf": [
{
"field": "Microsoft.Network/frontdoorwebapplicationfirewallpolicies/managedRules.managedRuleSets[*].ruleSetType",
"in": [
"DefaultRuleSet",
"Microsoft_DefaultRuleSet"
]
},
{
"field": "Microsoft.Network/frontdoorwebapplicationfirewallpolicies/managedRules.managedRuleSets[*].ruleSetVersion",
"in": [
"1.0",
"1.1"
]
}
]
}
},
"greater": 0
}
]
},
{
"allOf": [
{
"field": "Microsoft.Network/frontdoorwebapplicationfirewallpolicies/managedRules.managedRuleSets[*]",
"exists": "false"
}
]
},
{
"allOf": [
{
"count": {
"field": "Microsoft.Network/frontdoorwebapplicationfirewallpolicies/managedRules.managedRuleSets[*]"
},
"equals": 0
}
]
}
]
}
]
}
]
},
"then": {
"effect": "[parameters('effect')]"
}
}
}
}
6 changes: 6 additions & 0 deletions ...gacy or deprecated WAF rulesets on Application Gateway and Front Door/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# Audit Legacy and Deprecated WAF Rulesets

This Azure Policy definition audits Web Application Firewall policies that use legacy or deprecated OWASP Core Rule Set (CRS) or Microsoft Default Rule Set (DRS) rulesets across Application Gateway and Azure Front Door.

It is important to use the latest rulesets instead of deprecated ones to benefit from improved security coverage and reduced false positives that come with newer rule versions.

Loading