Updates

Author: johndowns

articles/web-application-firewall/ag/application-gateway-waf-configuration.md

@@ -12,7 +12,7 @@ ms.custom: devx-track-azurepowershell
 
 # Web Application Firewall exclusion lists
 
-The Azure Application Gateway Web Application Firewall (WAF) provides protection for web applications. This article describes WAF request size limits and exclusion lists configuration. These settings are located in the WAF Policy associated to your Application Gateway. To learn more about WAF Policies, see [Azure Web Application Firewall on Azure Application Gateway](ag-overview.md) and [Create Web Application Firewall policies for Application Gateway](create-waf-policy-ag.md)
+The Azure Application Gateway Web Application Firewall (WAF) provides protection for web applications. This article describes the configuration for WAF exclusion lists. These settings are located in the WAF Policy associated to your Application Gateway. To learn more about WAF Policies, see [Azure Web Application Firewall on Azure Application Gateway](ag-overview.md) and [Create Web Application Firewall policies for Application Gateway](create-waf-policy-ag.md)
 
 Sometimes Web Application Firewall (WAF) might block a request that you want to allow for your application. WAF exclusion lists allow you to omit certain request attributes from a WAF evaluation. The rest of the request is evaluated as normal.
 

articles/web-application-firewall/ag/application-gateway-waf-request-size-limits.md

@@ -44,6 +44,8 @@ WAF also offers a configurable knob to turn the request body inspection on or of
 
 Turning off the request body inspection allows for messages larger than 128 KB to be sent to WAF, but the message body isn't inspected for vulnerabilities.
 
+When your WAF policy is in prevention mode, WAF blocks requests that are over the size limit. When your WAF policy is in detection mode, then the behavior depends on the version of the managed ruleset you use. If you use CRS 3.2 and above, WAF inspects the body up to the limit specified and ignores the rest. If you use CRS version 3.1 or earlier, WAF inspects the entire message.
+
 ## Next steps
 
 After you configure your WAF settings, you can learn how to view your WAF logs. For more information, see [Application Gateway diagnostics](../../application-gateway/application-gateway-diagnostics.md#diagnostic-logging).