liveBook · Manning

Managed rule set

As explained in Azure Security

A managed rule set is a provider-maintained collection of firewall rules that can be applied to inspect and filter requests.

A managed rule set is a Microsoft-maintained collection of web application firewall rules added to an Azure WAF policy. It can supply OWASP Core Rule Set protection and managed bot protection without defining each rule individually. Microsoft-managed sets are updated to remain current; select the latest available version as a best practice. section 3.3.1 section 3.3.2

Apply managed rule sets as part of a WAF policy rollout:

  • Create a WAF policy with an OWASP managed rule set, specifying its type and version. section 3.3.1 section 3.3.2
  • Add Microsoft-managed bot protection to use threat intelligence for identifying malicious bot activity. section 3.3.1 section 3.3.2
  • Associate the policy with an Application Gateway v2 or associate it with Azure Front Door through a security policy. section 3.3.1 section 3.3.2
  • Start in Detection mode to log matching requests without blocking them, then enable Prevention mode to block requests that match the rule sets. section 3.3.1 section 3.3.2

OWASP rules plus bot protection

An Application Gateway WAF policy can contain both an OWASP rule set and Microsoft_BotManagerRuleSet. Once associated with the gateway, enabling the policy in Prevention mode evaluates incoming requests against both sets and blocks matches. section 3.3.1

Listing 3.13 Adding a managed rule set to a WAF policy for Azure Front Door
az network front-door waf-policy managed-rules add 
--policy-name AzFrontDoorWafPolicy    #1
--resource-group myResourceGroup      #2
--type Microsoft_DefaultRuleSet       #3
--version 1.1                         #4
#1 The name of the WAF policy
#2 The resource group in which the WAF policy is deployed
#3 The type of managed rule set; here, you use the rule set based on OWASP CRSs
#4 The version of the managed rule set; as a best practice, use the latest version

Use this Azure CLI pattern to add the Microsoft Default Rule Set to an Azure Front Door WAF policy; the rule-set type and version are explicit configuration choices. section 3.3.2

How Azure Security covers it

How deep it goes
Walks through creating policies, adding versioned rule sets, associating policies, and switching from detection to prevention rather than detailing individual rules.
Examples
Demonstrates Azure CLI policies using OWASP 3.2 and BotManager 0.1 for Application Gateway, plus DefaultRuleSet 1.1 and BotManager 1.0 for Front Door.
What you can do after
Apply it via Azure CLI to attach OWASP and bot rule sets to a WAF policy and enforce matching-request blocking.
How it connects
Connects Azure WAF with OWASP Core Rule Set, managed bot protection, Application Gateway, Azure Front Door, detection mode, and prevention mode.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.