Skip to content

Commit d2d748c

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #271654 from vhorne/waf-sensitive-data
updates for afds sensitive data protection
2 parents fe72c4d + eed00f1 commit d2d748c

File tree

5 files changed

+117
-2
lines changed

5 files changed

+117
-2
lines changed

‎articles/web-application-firewall/afds/waf-sensitive-data-protection-configure-frontdoor.md

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
title: How to mask sensitive data on Azure Web Application Firewall on Azure Front Door (preview)
3+
description: Learn how to mask sensitive data on Azure Web Application Firewall on Azure Front Door.
4+
author: vhorne
5+
ms.author: victorh
6+
ms.service: web-application-firewall
7+
ms.topic: how-to
8+
ms.date: 04/09/2024
9+
---
10+
11+
# How to mask sensitive data on Azure Web Application Firewall on Azure Front Door (preview)
12+
13+
> [!IMPORTANT]
14+
> Web Application Firewall on Azure Front Door Sensitive Data Protection is currently in PREVIEW.
15+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
16+
17+
The Web Application Firewall's (WAF) Log Scrubbing tool helps you remove sensitive data from your WAF logs. It works by using a rules engine that allows you to build custom rules to identify specific portions of a request that contain sensitive data. Once identified, the tool scrubs that information from your logs and replaces it with _*******_.
18+
19+
> [!NOTE]
20+
> When you enable the log scrubbing feature, Microsoft still retains IP addresses in our internal logs to support critical security features.
21+
22+
The following table shows examples of log scrubbing rules that can be used to protect your sensitive data:
23+
24+
| Match Variable | Operator | Selector | What gets scrubbed |
25+
| --- | --- | --- | --- |
26+
| Request Header Names | Equals | keytoblock | {"matchVariableName":"HeaderValue:keytoblock","matchVariableValue":"****"} |
27+
| Request Cookie Names | Equals | cookietoblock | {"matchVariableName":"CookieValue:cookietoblock","matchVariableValue":"****"} |
28+
| Request Post Arg Names | Equals | var | {"matchVariableName":"PostParamValue:var","matchVariableValue":"****"} |
29+
| Request Body JSON Arg Names | Equals | JsonValue | {"matchVariableName":"JsonValue:key","matchVariableValue":"****"} |
30+
| Query String Arg Names | Equals | foo | {"matchVariableName":"QueryParamValue:foo","matchVariableValue":"****"} |
31+
| Request IP Address* | Equals Any | NULL | {"matchVariableName":"ClientIP","matchVariableValue":"****"} |
32+
| Request URI | Equals Any | NULL | {"matchVariableName":"URI","matchVariableValue":"****"} |
33+
34+
\* Request IP Address and Request URI rules only support the *equals any* operator and scrubs all instances of the requestor's IP address that appears in the WAF logs.
35+
36+
For more information, see [What is Azure Web Application Firewall on Azure Front Door Sensitive Data Protection?](waf-sensitive-data-protection-frontdoor.md)
37+
38+
## Enable Sensitive Data Protection
39+
40+
Use the following information to enable and configure Sensitive Data Protection.
41+
42+
### Portal
43+
44+
To enable Sensitive Data Protection:
45+
46+
1. Open an existing Front Door WAF policy.
47+
1. Under **Settings**, select **Sensitive data**.
48+
1. On the **Sensitive data** page, select **Enable log scrubbing**.
49+
50+
To configure Log Scrubbing rules for Sensitive Data Protection:
51+
52+
1. Under **Log scrubbing rules**, select a **Match variable**.
53+
1. Select an **Operator** (if applicable).
54+
1. Type a **Selector** (if applicable).
55+
1. Select **Save**.
56+
57+
Repeat to add more rules.
58+
59+
## Verify Sensitive Data Protection
60+
61+
To verify your Sensitive Data Protection rules, open the Front Door firewall log and search for _******_ in place of the sensitive fields.
62+
63+
## Next steps
64+
65+
- [Use Log Analytics to examine Application Gateway Web Application Firewall (WAF) logs](../ag/log-analytics.md)

‎articles/web-application-firewall/afds/waf-sensitive-data-protection-frontdoor.md

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
title: Azure Web Application Firewall on Azure Front Door Sensitive Data Protection (preview)
3+
description: Learn about Azure Web Application Firewall Azure Front Door Sensitive Data Protection.
4+
author: vhorne
5+
ms.author: victorh
6+
ms.service: web-application-firewall
7+
ms.topic: conceptual
8+
ms.date: 04/09/2024
9+
---
10+
11+
# What is Azure Web Application Firewall on Azure Front Door Sensitive Data Protection (preview)?
12+
13+
> [!IMPORTANT]
14+
> Web Application Firewall on Azure Front Door Sensitive Data Protection is currently in PREVIEW.
15+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
16+
17+
The Web Application Firewall's (WAF) Log Scrubbing tool helps you remove sensitive data from your WAF logs. It works by using a rules engine that allows you to build custom rules to identify specific portions of a request that contain sensitive information. Once identified, the tool scrubs that information from your logs and replaces it with _*******_.
18+
19+
> [!NOTE]
20+
> When you enable the log scrubbing feature, Microsoft still retains IP addresses in our internal logs to support critical security features.
21+
22+
## Default log behavior
23+
24+
Normally, when a WAF rule is triggered, the WAF logs the details of the request in clear text. If the portion of the request triggering the WAF rule contains sensitive data (such as customer passwords or IP addresses), that sensitive data is viewable by anyone with access to the WAF logs. To protect customer data, you can set up Log Scrubbing rules targeting this sensitive data for protection.
25+
26+
## Fields
27+
28+
The following fields can be scrubbed from the logs:
29+
30+
- Request Header Names
31+
- Request Cookie Names
32+
- Request Body Post Arg Names
33+
- Request Body Json Arg Names
34+
- Query String Arg Names
35+
- Request URI
36+
- Request IP Address
37+
38+
## Next steps
39+
40+
- [How to mask sensitive data on Azure Web Application Firewall on Azure Front Door (preview)](waf-sensitive-data-protection-configure-frontdoor.md)

‎articles/web-application-firewall/ag/waf-sensitive-data-protection-configure.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ ms.date: 09/05/2023
1212

1313
The Web Application Firewall's (WAF's) Log Scrubbing tool helps you remove sensitive data from your WAF logs. It works by using a rules engine that allows you to build custom rules to identify specific portions of a request that contain sensitive data. Once identified, the tool scrubs that information from your logs and replaces it with _*******_.
1414

15+
> [!NOTE]
16+
> When you enable the log scrubbing feature, Microsoft still retains IP addresses in our internal logs to support critical security features.
17+
1518
The following table shows examples of log scrubbing rules that can be used to protect your sensitive data:
1619

1720
| Match Variable | Operator | Selector | What gets scrubbed |

‎articles/web-application-firewall/ag/waf-sensitive-data-protection.md

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,15 @@ author: vhorne
55
ms.author: victorh
66
ms.service: web-application-firewall
77
ms.topic: conceptual
8-
ms.date: 09/05/2023
8+
ms.date: 04/10/2024
99
---
1010

1111
# What is Azure Web Application Firewall Sensitive Data Protection?
1212

13-
The Web Application Firewall's (WAF's) Log Scrubbing tool helps you remove sensitive data from your WAF logs. It works by using a rules engine that allows you to build custom rules to identify specific portions of a request that contain sensitive information. Once identified, the tool scrubs that information from your logs and replaces it with _*******_.
13+
The Web Application Firewall's (WAF) Log Scrubbing tool helps you remove sensitive data from your WAF logs. It works by using a rules engine that allows you to build custom rules to identify specific portions of a request that contain sensitive information. Once identified, the tool scrubs that information from your logs and replaces it with _*******_.
14+
15+
> [!NOTE]
16+
> When you enable the log scrubbing feature, Microsoft still retains IP addresses in our internal logs to support critical security features.
1417
1518

1619
## Default log behavior

‎articles/web-application-firewall/toc.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,8 @@
8080
href: ./afds/waf-front-door-exclusion.md
8181
- name: Policy settings
8282
href: ./afds/waf-front-door-policy-settings.md
83+
- name: Sensitive Data Protection
84+
href: ./afds/waf-sensitive-data-protection-frontdoor.md
8385
- name: Rate limiting
8486
href: ./afds/waf-front-door-rate-limit.md
8587
- name: Geo-filtering
@@ -154,6 +156,8 @@
154156
href: ./afds/waf-front-door-configure-custom-response-code.md
155157
- name: Configure IP restrictions
156158
href: ./afds/waf-front-door-configure-ip-restriction.md
159+
- name: Mask sensitive data
160+
href: ./afds/waf-sensitive-data-protection-configure-frontdoor.md
157161
- name: Configure rate limit
158162
href: ./afds/waf-front-door-rate-limit-configure.md
159163
- name: Configure a geo-filtering WAF policy

0 commit comments

Comments
 (0)