|
| 1 | +--- |
| 2 | +pcx_content_type: troubleshooting |
| 3 | +title: Troubleshoot managed rules |
| 4 | +sidebar: |
| 5 | + order: 4 |
| 6 | + label: Troubleshooting |
| 7 | +--- |
| 8 | + |
| 9 | +import { RuleID } from "~/components"; |
| 10 | + |
| 11 | +By default, WAF's managed rulesets are compatible with most websites and web applications. However, false positives and false negatives may occur: |
| 12 | + |
| 13 | +- **False positives**: Legitimate requests detected and mitigated as malicious. |
| 14 | +- **False negatives**: Malicious requests that were not mitigated and reached your origin server. |
| 15 | + |
| 16 | +## Troubleshoot false positives |
| 17 | + |
| 18 | +You can use [Security Events](/waf/analytics/security-events/) to help you identify what caused legitimate requests to get blocked. Add filters and adjust the report duration as needed. |
| 19 | + |
| 20 | +If you encounter a false positive caused by a managed rule, do one of the following: |
| 21 | + |
| 22 | +- **Add an exception**: [Exceptions](/waf/managed-rules/waf-exceptions/) allow you to skip the execution of WAF managed rulesets or some of their rules for certain requests. |
| 23 | + |
| 24 | +- **Adjust the OWASP managed ruleset**: A request blocked by the rule with ID <RuleID id="6179ae15870a4bb7b2d480d4843b323c" /> and description `949110: Inbound Anomaly Score Exceeded` refers to the [Cloudflare OWASP Core Ruleset](/waf/managed-rules/reference/owasp-core-ruleset/). To resolve the issue, [configure the OWASP managed ruleset](/waf/managed-rules/reference/owasp-core-ruleset/configure-dashboard/). |
| 25 | + |
| 26 | +- **Disable the corresponding managed rule(s)**: Create an override to disable specific rules. This may avoid false positives, but you will also reduce the overall site security. Refer to the [dashboard instructions](/waf/managed-rules/deploy-zone-dashboard/#configure-a-managed-ruleset) on configuring a managed ruleset, or to the [API instructions](/ruleset-engine/managed-rulesets/override-managed-ruleset/) on creating an override. |
| 27 | + |
| 28 | +:::note |
| 29 | +If you contact Cloudflare Support to verify whether a WAF managed rule triggers as expected, [provide a HAR file](/support/troubleshooting/general-troubleshooting/gathering-information-for-troubleshooting-sites/#generate-a-har-file) captured while sending the specific request of concern. |
| 30 | +::: |
| 31 | + |
| 32 | +### Additional recommendations |
| 33 | + |
| 34 | +- If one specific rule causes false positives, disable that specific rule and not the entire ruleset. |
| 35 | + |
| 36 | +- For false positives with the administrator area of your website, add an [exception](/waf/managed-rules/waf-exceptions/) disabling a managed rule for the admin section of your site resources. You can use an expression similar to the following: |
| 37 | + |
| 38 | + `http.host eq "example.com" and starts_with(http.request.uri.path, "/admin")` |
| 39 | + |
| 40 | +## Troubleshoot false negatives |
| 41 | + |
| 42 | +To identify false negatives, review the HTTP logs on your origin server. |
| 43 | + |
| 44 | +To reduce false negatives, use the following checklist: |
| 45 | + |
| 46 | +- Are DNS records that serve HTTP traffic [proxied through Cloudflare](/dns/proxy-status/)?<br/> |
| 47 | + Cloudflare only mitigates requests in proxied traffic. |
| 48 | + |
| 49 | +- Have you deployed any of the [WAF managed rulesets](/waf/managed-rules/#available-managed-rulesets) in your zone?<br/> |
| 50 | + You must [deploy a managed ruleset](/waf/managed-rules/deploy-zone-dashboard/#deploy-a-managed-ruleset) to apply its rules. |
| 51 | + |
| 52 | +- Are Managed Rules being skipped via an [exception](/waf/managed-rules/waf-exceptions/)?<br/> |
| 53 | + Use [Security Events](/waf/analytics/security-events/) to search for requests being skipped. If necessary, adjust the exception expression so that it matches the attack traffic that should have been blocked. |
| 54 | + |
| 55 | +- Have you enabled any necessary managed rules that are not enabled by default?<br/> |
| 56 | + Not all rules of WAF managed rulesets are enabled by default, so you should review individual managed rules. |
| 57 | + - For example, Cloudflare allows requests with empty user agents by default. To block requests with an empty user agent, enable the rule with ID <RuleID id="b57df4f17f7f4ea4b8db33e20a6dbbd3"/> in the Cloudflare Managed Ruleset. |
| 58 | + - Another example: If you want to block unmitigated SQL injection (SQLi) attacks, make sure the relevant managed rules tagged with `sqli` are enabled in the Cloudflare Managed Ruleset. |
| 59 | + |
| 60 | + For instructions, refer to [Configure a managed ruleset](/waf/managed-rules/deploy-zone-dashboard/#configure-a-managed-ruleset). |
| 61 | + |
| 62 | +- Is the attack traffic matching a custom rule [skipping all Managed Rules](/waf/custom-rules/skip/)?<br/> |
| 63 | + If necessary, adjust the custom rule expression so that it does not apply to the attack traffic. |
| 64 | + |
| 65 | +- Is the attack traffic matching an allowed ASN, IP range, or IP address in [IP Access rules](/waf/tools/ip-access-rules/)?<br/> |
| 66 | + Review your IP Access rules and make sure that any allow rules do not match the attack traffic. |
| 67 | + |
| 68 | +- Is the malicious traffic reaching your origin IP addresses directly, therefore bypassing Cloudflare protection?<br/> |
| 69 | + Block all traffic except from [Cloudflare's IP addresses](/fundamentals/concepts/cloudflare-ip-addresses/) at your origin server. |
0 commit comments