You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: With exploration, Personalizer is able to continue delivering good results, even as user behavior changes. Choosing an exploration setting is a business decision about the proportion of user interactions to explore with, in order to improve the model.
4
+
description: With exploration, Personalizer is able to continuously deliver good results, even as user behavior changes. Choosing an exploration setting is a business decision about the proportion of user interactions to explore with, in order to improve the model.
5
5
author: jcodella
6
6
ms.author: jacodel
7
7
ms.manager: nitinme
8
8
ms.service: cognitive-services
9
9
ms.subservice: personalizer
10
10
ms.topic: conceptual
11
-
ms.date: 10/23/2019
11
+
ms.date: 08/28/2022
12
12
---
13
13
14
-
# Exploration and exploitation
14
+
# Exploration and Known
15
15
16
-
With exploration, Personalizer is able to continue delivering good results, even as user behavior changes.
16
+
With exploration, Personalizer is able to continuously deliver good results, even as user behavior changes.
17
17
18
18
When Personalizer receives a Rank call, it returns a RewardActionID that either:
19
-
* Uses exploitation to match the most probable user behavior based on the current machine learning model.
19
+
* Uses known relevance to match the most probable user behavior based on the current machine learning model.
20
20
* Uses exploration, which does not match the action that has the highest probability in the rank.
21
21
22
22
Personalizer currently uses an algorithm called *epsilon greedy* to explore.
@@ -25,7 +25,7 @@ Personalizer currently uses an algorithm called *epsilon greedy* to explore.
25
25
26
26
You configure the percentage of traffic to use for exploration in the Azure portal's **Configuration** page for Personalizer. This setting determines the percentage of Rank calls that perform exploration.
27
27
28
-
Personalizer determines whether to explore or exploit with this probability on each rank call. This is different than the behavior in some A/B frameworks that lock a treatment on specific user IDs.
28
+
Personalizer determines whether to explore or use the model's learned best action with this probability on each rank call. This is different than the behavior in some A/B frameworks that lock a treatment on specific user IDs.
29
29
30
30
## Best practices for choosing an exploration setting
31
31
@@ -35,8 +35,8 @@ A setting of zero will negate many of the benefits of Personalizer. With this se
35
35
36
36
A setting that is too high will negate the benefits of learning from user behavior. Setting it to 100% implies a constant randomization, and any learned behavior from users would not influence the outcome.
37
37
38
-
It is important not to change the application behavior based on whether you see if Personalizer is exploring or exploiting. This would lead to learning biases that ultimately would decrease the potential performance.
38
+
It is important not to change the application behavior based on whether you see if Personalizer is exploring or using the learned best action. This would lead to learning biases that ultimately would decrease the potential performance.
title: Azure Resource Manager templates for Azure Front Door and Web Application Firewall
3
+
description: Azure Resource Manager templates for Azure Front Door Web Application Firewall
4
+
services: web-application-firewall
5
+
author: johndowns
6
+
ms.service: web-application-firewall
7
+
ms.topic: sample
8
+
ms.date: 08/16/2022
9
+
ms.author: jodowns
10
+
zone_pivot_groups: front-door-tiers
11
+
---
12
+
# Azure Resource Manager templates for Azure Front Door and Web Application Firewall
13
+
14
+
The following table includes links to Azure Resource Manager templates for Azure Front Door and Web Application Firewall.
15
+
16
+
::: zone pivot="front-door-standard-premium"
17
+
18
+
| Template | Description |
19
+
| -------- | ----------- |
20
+
|[Front Door with Web Application Firewall and managed rule set](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.cdn/front-door-premium-waf-managed/)| Creates a Front Door profile and WAF with managed rule set. |
21
+
|[Front Door with Web Application Firewall and custom rule](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.cdn/front-door-standard-premium-waf-custom/)| Creates a Front Door profile and WAF with custom rule. |
22
+
|[Front Door with Web Application Firewall and rate limit](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.cdn/front-door-standard-premium-rate-limit/)| Creates a Front Door profile and WAF with a custom rule to perform rate limiting. |
23
+
|[Front Door with Web Application Firewall and geo-filtering](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.cdn/front-door-standard-premium-geo-filtering/)| Creates a Front Door profile and WAF with a custom rule to perform geo-filtering. |
24
+
25
+
::: zone-end
26
+
27
+
::: zone pivot="front-door-classic"
28
+
29
+
| Template | Description |
30
+
| ---| ---|
31
+
|[Create Front Door with geo filtering](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.network/front-door-geo-filtering)| Create a Front Door that allows/blocks traffic from certain countries/regions. |
32
+
|[Configure Front Door for client IP allowlisting or blocklisting](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.network/front-door-waf-clientip)| Configures a Front Door to restrict traffic certain client IPs using custom access control using client IPs. |
33
+
|[Configure Front Door to take action with specific http parameters](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.network/front-door-waf-http-params)| Configures a Front Door to allow or block certain traffic based on the http parameters in the incoming request by using custom rules for access control using http parameters. |
34
+
|[Configure Front Door rate limiting](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.network/front-door-rate-limiting)| Configures a Front Door to rate limit incoming traffic for a given frontend host. |
# Web Application Firewall DRS rule groups and rules
12
12
13
13
Azure Front Door web application firewall (WAF) protects web applications from common vulnerabilities and exploits. Azure-managed rule sets provide an easy way to deploy protection against a common set of security threats. Since such rule sets are managed by Azure, the rules are updated as needed to protect against new attack signatures. Default rule set also includes the Microsoft Threat Intelligence Collection rules that are written in partnership with the Microsoft Intelligence team to provide increased coverage, patches for specific vulnerabilities, and better false positive reduction.
14
14
15
-
16
15
## Default rule sets
17
16
18
-
Azure-managed Default Rule Set includes rules against the following threat categories:
17
+
The Azure-managed Default Rule Set (DRS) includes rules against the following threat categories:
19
18
20
19
- Cross-site scripting
21
20
- Java attacks
@@ -27,40 +26,42 @@ Azure-managed Default Rule Set includes rules against the following threat categ
27
26
- SQL injection protection
28
27
- Protocol attackers
29
28
30
-
The version number of the Default Rule Set increments when new attack signatures are added to the rule set.
31
-
Default Rule Set is enabled by default in Detection mode in your WAF policies. You can disable or enable individual rules within the Default Rule Set to meet your application requirements. You can also set specific actions (ALLOW/BLOCK/REDIRECT/LOG) per rule.
29
+
The version number of the DRS increments when new attack signatures are added to the rule set.
30
+
31
+
DRS is enabled by default in Detection mode in your WAF policies. You can disable or enable individual rules within the Default Rule Set to meet your application requirements. You can also set specific actions per rule. The available actions are: [Allow, Block, Log, and Redirect](afds-overview.md#waf-actions).
32
32
33
-
Sometimes you may need to omit certain request attributes from a WAF evaluation. A common example is Active Directory-inserted tokens that are used for authentication. You may configure an exclusion list for a managed rule, rule group, or for the entire rule set.
33
+
Sometimes you might need to omit certain request attributes from a WAF evaluation. A common example is Active Directory-inserted tokens that are used for authentication. You may configure an exclusion list for a managed rule, rule group, or for the entire rule set. For more information, see [Web Application Firewall (WAF) with Front Door exclusion lists](./waf-front-door-exclusion.md).
34
34
35
-
The Default action is to BLOCK. Additionally, custom rules can be configured in the same WAF policy if you wish to bypass any of the pre-configured rules in the Default Rule Set.
35
+
By default, DRS blocks requests that trigger the rules. Additionally, custom rules can be configured in the same WAF policy if you wish to bypass any of the pre-configured rules in the Default Rule Set.
36
36
37
37
Custom rules are always applied before rules in the Default Rule Set are evaluated. If a request matches a custom rule, the corresponding rule action is applied. The request is either blocked or passed through to the back-end. No other custom rules or the rules in the Default Rule Set are processed. You can also remove the Default Rule Set from your WAF policies.
38
38
39
39
### Microsoft Threat Intelligence Collection rules
40
40
41
-
The Microsoft Threat Intelligence Collection rules are written in partnership with the Microsoft Intelligence team to provide increased coverage, patches for specific vulnerabilities, and better false positive reduction.
41
+
The Microsoft Threat Intelligence Collection rules are written in partnership with the Microsoft Threat Intelligence team to provide increased coverage, patches for specific vulnerabilities, and better false positive reduction.
OWASP has two modes for deciding whether to block traffic: Traditional mode and Anomaly Scoring mode.
45
+
When you use DRS 2.0 or later, your WAF uses *anomaly scoring*. Traffic that matches any rule isn't immediately blocked, even when your WAF is in prevention mode. Instead, the OWASP rule sets define a severity for each rule: *Critical*, *Error*, *Warning*, or *Notice*. The severity affects a numeric value for the request, which is called the *anomaly score*:
46
46
47
-
In Traditional mode, traffic that matches any rule is considered independently of any other rule matches. This mode is easy to understand. But the lack of information about how many rules match a specific request is a limitation. So, Anomaly Scoring mode was introduced. It's the default for OWASP 3.*x*.
47
+
| Rule severity | Values contributes to anomaly score |
48
+
|-|-|
49
+
| Critical | 5 |
50
+
| Error | 4 |
51
+
| Warning | 3 |
52
+
| Notice | 2 |
48
53
49
-
In Anomaly Scoring mode, traffic that matches any rule isn't immediately blocked when the firewall is in Prevention mode. Rules have a certain severity: *Critical*, *Error*, *Warning*, or *Notice*. That severity affects a numeric value for the request, which is called the Anomaly Score. For example, one *Warning* rule match contributes 3 to the score. One *Critical* rule match contributes 5.
54
+
If the anomaly score is 5 or greater, WAF blocks the request.
50
55
51
-
|Severity |Value |
52
-
|---------|---------|
53
-
|Critical |5|
54
-
|Error |4|
55
-
|Warning |3|
56
-
|Notice |2|
56
+
For example, a single *Critical* rule match is enough for the WAF to block a request, because the overall anomaly score is 5. However, one *Warning* rule match only increases the anomaly score by 3, which isn't enough by itself to block the traffic.
57
57
58
-
There's a threshold of 5 for the Anomaly Score to block traffic. So, a single *Critical* rule match is enough for the WAF to block a request, even in Prevention mode. But one *Warning*rule match only increases the Anomaly Score by 3, which isn't enough by itself to block the traffic. For more information, see [What content types does WAF support?](waf-faq.yml#what-content-types-does-waf-support-) in the FAQ to learn what content types are supported for body inspection with different DRS versions.
58
+
When your WAF uses older version of the default rule set (before DRS 2.0), your WAF runs in the traditional mode. Traffic that matches any rule is considered independently of any other rule matches. In traditional mode, you don't have visiblity into the complete set of rules that a specific request matched.
59
59
60
+
The version of the DRS that you use also determines which content types are supported for request body inspection. For more information, see [What content types does WAF support?](waf-faq.yml#what-content-types-does-waf-support-) in the FAQ.
60
61
61
62
### DRS 2.0
62
63
63
-
DRS 2.0 includes 17 rule groups, as shown in the following table. Each group contains multiple rules, which can be disabled.
64
+
DRS 2.0 includes 17 rule groups, as shown in the following table. Each group contains multiple rules, and you can disable individual rules as well as entire rule groups.
64
65
65
66
> [!NOTE]
66
67
> DRS 2.0 is only available on Azure Front Door Premium.
@@ -118,9 +119,6 @@ DRS 2.0 includes 17 rule groups, as shown in the following table. Each group con
118
119
|**[MS-ThreatIntel-WebShells](#drs9905-10)**|Protect against Web shell attacks|
119
120
|**[MS-ThreatIntel-CVEs](#drs99001-10)**|Protect against CVE attacks|
120
121
121
-
122
-
123
-
124
122
### Bot rules
125
123
126
124
|Rule group|Description|
@@ -129,10 +127,7 @@ DRS 2.0 includes 17 rule groups, as shown in the following table. Each group con
The following rule groups and rules are available when using Web Application Firewall on Azure
135
-
Front Door.
130
+
The following rule groups and rules are available when using Web Application Firewall on Azure Front Door.
136
131
137
132
# [DRS 2.0](#tab/drs20)
138
133
@@ -289,7 +284,6 @@ Front Door.
289
284
>[!NOTE]
290
285
> This article contains references to the term *blacklist*, a term that Microsoft no longer uses. When the term is removed from the software, we’ll remove it from this article.
291
286
292
-
293
287
### <aname="drs942-20"></a> SQLI - SQL Injection
294
288
|RuleId|Description|
295
289
|---|---|
@@ -335,7 +329,6 @@ Front Door.
335
329
|942500|MySQL in-line comment detected.|
336
330
|942510|SQLi bypass attempt by ticks or backticks detected.|
337
331
338
-
339
332
### <aname="drs943-20"></a> SESSION-FIXATION
340
333
|RuleId|Description|
341
334
|---|---|
@@ -383,6 +376,13 @@ Front Door.
383
376
|99001015|Attempted Spring Framework unsafe class object exploitation [CVE-2022-22965](https://www.cve.org/CVERecord?id=CVE-2022-22965)|
384
377
|99001016|Attempted Spring Cloud Gateway Actuator injection [CVE-2022-22947](https://www.cve.org/CVERecord?id=CVE-2022-22947)
385
378
379
+
> [!NOTE]
380
+
> When reviewing your WAF's logs, you might see rule ID 949110. The description of the rule might include *Inbound Anomaly Score Exceeded*.
381
+
>
382
+
> This rule indicates that the total anomaly score for the request exceeded the maximum allowable score. For more information, see [Anomaly scoring](#anomaly-scoring-mode).
383
+
>
384
+
> When you tune your WAF policies, you need to investigate the other rules that were triggered by the request so that you can adjust your WAF's configuration. For more information, see [Tuning Web Application Firewall (WAF) for Azure Front Door](waf-front-door-tuning.md).
Copy file name to clipboardExpand all lines: articles/web-application-firewall/afds/waf-front-door-exclusion.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.author: victorh
9
9
ms.topic: conceptual
10
10
---
11
11
12
-
# Web Application Firewall (WAF) with Front Door Service exclusion lists
12
+
# Web Application Firewall (WAF) with Front Door exclusion lists
13
13
14
14
Sometimes Web Application Firewall (WAF) might block a request that you want to allow for your application. WAF exclusion lists allow you to omit certain request attributes from a WAF evaluation. The rest of the request is evaluated as normal.
@@ -275,6 +275,12 @@ Another way to view request and response headers is to look inside the developer
275
275
276
276
If the request contains cookies, the Cookies tab can be selected to view them in Fiddler. Cookie information can also be used to create exclusions or custom rules in WAF.
277
277
278
+
## Anomaly scoring rule
279
+
280
+
If you see rule ID 949110 during the process of tuning your WAF, this indicates that the request was blocked by the [anomaly scoring](waf-front-door-drs.md#anomaly-scoring-mode) process.
281
+
282
+
Review the other WAF log entries for the same request, by searching for the log entries with the same tracking reference. Look at each of the rules that were triggered, and tune each rule by following the guidance throughout this article.
283
+
278
284
## Next steps
279
285
280
286
- Learn about [Azure web application firewall](../overview.md).
0 commit comments