Skip to content

Commit d721496

Browse files
Add File Upload Anomaly Score Threshold effects
Added clarification on the impact of the OWASP Anomaly Score Threshold on file uploads and false positives. Previously documented below https://developers.cloudflare.com/waf/reference/legacy/old-waf-managed-rules/#owasp-modsecurity-core-rule-set:~:text=With%20a%20high%20sensitivity%2C%20large%20file%20uploads%20will%20trigger%20the%20WAF.
1 parent 5ef9b64 commit d721496

File tree

1 file changed

+5
-1
lines changed
  • src/content/docs/waf/managed-rules/reference/owasp-core-ruleset

1 file changed

+5
-1
lines changed

src/content/docs/waf/managed-rules/reference/owasp-core-ruleset/concepts.mdx

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,4 +37,8 @@ The available score thresholds are the following:
3737
- _Medium – 40 and higher_ (default value)
3838
- _High – 25 and higher_
3939

40-
Each threshold (_Low_, _Medium_, and _High_) has an associated value (_60_, _40_, and _25_, respectively). Configuring a _Low_ threshold means that more rules will have to match the current request for the WAF to apply the configured ruleset action. For an example, refer to [OWASP evaluation example](/waf/managed-rules/reference/owasp-core-ruleset/example/).
40+
Each threshold (_Low_, _Medium_, and _High_) has an associated value (_60_, _40_, and _25_, respectively). Configuring a _Low_ threshold means that more rules will have to match the current request for the WAF to apply the configured ruleset action.
41+
42+
When the OWASP Anomaly Score Threshold is set to _High_, file uploads may trigger the `949110: Inbound Anomaly Score Exceeded` rule due to the lower amount scoring rules needed. Consider adjusting the threshold level, individual counting rules, or making an exception if excessive false positives occur.
43+
44+
For an example, refer to [OWASP evaluation example](/waf/managed-rules/reference/owasp-core-ruleset/example/).

0 commit comments

Comments
 (0)