General availability: Feature enhancements to Azure Web Application Firewall (WAF)
Share
Services
Azure’s global Web Application Firewall (WAF) running on Azure Front Door, and Azure’s regional WAF running on Application Gateway, now support additional features that help organizations improve their security posture and make it easier to manage logging across resources.
* **SQL injection (SQLi) and cross site scripting (XSS) detection queries:** New Azure WAF analytics SQLi and XSS detection rule templates simplify the process of setting up automated detection and response with Microsoft’s security incident & event management (SIEM) service: Microsoft Sentinel. Learn more about [using Microsoft Sentinel with Azure WAF](https://learn.microsoft.com/en-us/azure/web-application-firewall/waf-sentinel), and about [how to use the new SQLi and XSS detection queries](https://techcommunity.microsoft.com/t5/azure-network-security-blog/automated-detection-and-response-for-azure-waf-with-sentinel/ba-p/3692525).
* **Azure policies for WAF logging:** The regional WAF on Application Gateway and the global WAF running on Azure Front Door now have built-in Azure policies requiring resource logs and metrics. This allows organizations to enforce standards for WAF deployments to collect logs and metrics for further analysis and insights related to security events. Learn more: [WAF and Azure Policy](https://learn.microsoft.com/en-us/azure/web-application-firewall/shared/waf-azure-policy)
In addition, Azure regional WAF on Application Gateway now has -
* **Increased exclusion limit:** CRS 3.2 or greater ruleset now supports exclusions limit up to 200, a 5x increase from older versions; allowing for greater customization on how the WAF handles managed rulesets. Learn more about the [Application Gateway’s limits](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#application-gateway-limits).
* **Bot Manager ruleset exclusion rules**: Exclusions are extended to Bot Manager Rule Set 1.0\. Learn more: [WAF exclusions](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration?tabs=portal).
* **Uppercase transform on custom rules:** You can now handle case sensitivity when creating custom WAF rules using uppercase transform in addition to the lowercase transform. Learn more about [WAF custom rules](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/custom-waf-rules-overview).
* Web Application Firewall
* Application Gateway
* Azure Front Door
* Features
* Security
* [ Application Gateway](https://azure.microsoft.com/en-gb/products/application-gateway/)
* [ Azure Front Door](https://azure.microsoft.com/en-gb/products/frontdoor/)
* [ Web Application Firewall](https://azure.microsoft.com/en-gb/products/web-application-firewall/)
What else is happening at Microsoft Azure?
Read update
Services
Share
Read update
Services
Share
We’re retiring Azure Time Series Insights on 7 July 2024 – transition to Azure Data Explorer
May 31st, 2024
Services
Share