Skip to content

Commit 9182fdd

Browse files
Update waf-front-door-drs.md
1 parent b6a2e45 commit 9182fdd

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

articles/web-application-firewall/afds/waf-front-door-drs.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,18 +66,18 @@ A single *Critical* rule match is enough for the WAF to block a request when in
6666

6767
When your WAF uses an older version of the Default Rule Set (before DRS 2.0), your WAF runs in the traditional mode. Traffic that matches any rule is considered independently of any other rule matches. In traditional mode, you don't have visibility into the complete set of rules that a specific request matched.
6868

69-
The version of the DRS that you use also determines which content types are supported for request body inspection. For more information, see [What content types does WAF support?](waf-faq.yml#what-content-types-does-waf-support-) in the FAQ.
69+
The version of the DRS that you use also determines which content types are supported for request body inspection. For more information, see [What content types does WAF support](waf-faq.yml#what-content-types-does-waf-support-) in the FAQ.
7070

7171
## Paranoia level
7272

73-
Each rule is asigned in a specific Paranoia Level (PL). Rules configured in Paranoia Level 1 (PL1) are less aggressive and hardly ever trigger a false positive. They provide baseline security with minimal need for fine tuning. Rules in PL2 detect more attacks, but they are expected to trigger false positives which should be fine-tuned.
73+
Each rule is assigned in a specific Paranoia Level (PL). Rules configured in Paranoia Level 1 (PL1) are less aggressive and hardly ever trigger a false positive. They provide baseline security with minimal need for fine tuning. Rules in PL2 detect more attacks, but they are expected to trigger false positives which should be fine-tuned.
7474

7575
By default, all DRS rule versions are pre-configured in Paranoia Level 2, including rules assigned in both PL1 and in PL2.
7676
If you want to use WAF exclusively with PL1, you can disable any or all PL2 rules or change their action to 'log'. PL3 and PL4 are currently not supported in Azure WAF.
7777

7878
### Upgrading or changing ruleset version
7979

80-
If you are upgrading, or assigning a new ruleset version, and would like to preserve existing rule overrides and exclusions, it is recommended to use PowerShell, CLI, REST API, or a templates to make ruleset version changes. A new version of a ruleset can have newer rules, additional rule groups, and may have updates to existing signatures to enforce better security and reduce false positives. It is recommended to validate changes in a test environment, fine tune if necessary, and then deploy in a production environment.
80+
If you are upgrading, or assigning a new ruleset version, and would like to preserve existing rule overrides and exclusions, it is recommended to use PowerShell, CLI, REST API, or a template to make ruleset version changes. A new version of a ruleset can have newer rules, additional rule groups, and may have updates to existing signatures to enforce better security and reduce false positives. It is recommended to validate changes in a test environment, fine tune if necessary, and then deploy in a production environment.
8181

8282
> [!NOTE]
8383
> If you are using the Azure portal to assign a new managed ruleset to a WAF policy, all the previous customizations from the existing managed ruleset such as rule state, rule actions, and rule level exclusions will be reset to the new managed ruleset's defaults. However, any custom rules, or policy settings will remain unaffected during the new ruleset assignment. You will need to redefine rule overrides and validate changes before deploying in a production environment.
@@ -655,7 +655,7 @@ The following rule groups and rules are available when you use Azure Web Applica
655655
|942250|Detects MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections.|
656656
|942260|Detects basic SQL authentication bypass attempts 2/3.|
657657
|942270|Looking for basic SQL injection. Common attack string for MySQL, Oracle, and others.|
658-
|942280|Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts.|
658+
|942280|Detects Postgres pg_sleep injection, wait for delay attacks and database shutdown attempts.|
659659
|942290|Finds basic MongoDB SQL injection attempts.|
660660
|942300|Detects MySQL comments, conditions, and ch(a)r injections.|
661661
|942310|Detects chained SQL injection attempts 2/2.|
@@ -846,7 +846,7 @@ The following rule groups and rules are available when you use Azure Web Applica
846846
|942250|Detects MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections.|
847847
|942260|Detects basic SQL authentication bypass attempts 2/3.|
848848
|942270|Looking for basic SQL injection. Common attack string for MySQL, Oracle, and others.|
849-
|942280|Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts.|
849+
|942280|Detects Postgres pg_sleep injection, wait for delay attacks and database shutdown attempts.|
850850
|942290|Finds basic MongoDB SQL injection attempts.|
851851
|942300|Detects MySQL comments, conditions and ch(a)r injections.|
852852
|942310|Detects chained SQL injection attempts 2/2.|

0 commit comments

Comments
 (0)