How deeply does Azure Security cover anomaly score?

Explains severity values, cumulative addition, and the prevention threshold, but does not detail individual rule logic.

Anomaly score

Anomaly scoring is a web application firewall evaluation method that assigns a cumulative score to detected request anomalies to determine whether traffic is blocked.

Anomaly scoring lets Azure WAF on Application Gateway evaluate suspicious requests cumulatively before deciding whether prevention mode should block them. section 3.3.1

Azure WAF assigns scores by rule severity:

Critical: 5; Error: 4; Warning: 3; Notice: 2. section 3.3.1
The score is cumulative across matching rules. section 3.3.1
Prevention mode blocks requests with a total score of 5 or higher. section 3.3.1

Combined rule matches

A request matching one rule scored 3 and another scored 2 reaches a cumulative anomaly score of 5, so prevention mode blocks it. section 3.3.1

Table 3.1 Possible values of severities and scores used in anomaly scoring (view table figure)

Severity	Score
Critical	5
Error	4
Warning	3
Notice	2

Use the severity-and-score table to compare the values that contribute to an anomaly score. section 3.3.1

How Azure Security covers it

liveBook manning.com

Read Azure Security on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Outlier Detection in PythonA numerical estimate of how unusual an item is relative to a specified reference group.

Compare how 2 books explain anomaly score →

Related concepts

reconstruction lossequivalent to · Reconstruction loss is a measure of the discrepancy between an input or observation and the output a model reconstructs from it or its representation.
signaluses · A signal is an observable value, event, or pattern that conveys information about a condition, state, or phenomenon.
isolation forestproduced by · Isolation Forest is an ensemble anomaly-detection algorithm that identifies unusual observations by recursively isolating them through random partitioning.
outlier detectionproduced by · Outlier detection is the process of identifying observations that substantially deviate from an expected or prevailing pattern in data.
univariate scoring methodproduced by · A technique that assigns an outlier score to each observation using one feature at a time.
ensembleused by · An ensemble is a technique that combines or considers outputs from multiple models or component methods collectively to produce or assess a joint result.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.