Configure WAF Managed Rules
最終更新日：2026-08-27 17:19:53
Reading time: About 8 minutes
Prerequisites: The hostname has been onboarded, and the WAF policy is enabled.
Rule Set Overview
The WAF Managed Rules set is maintained by security experts and covers OWASP Top 10 attack types and the latest CVE vulnerabilities, including SQL injection, cross-site scripting (XSS), command injection, file inclusion, deserialization vulnerabilities, and more.
The rule set is updated weekly, with urgent follow-up updates for major vulnerabilities (such as Log4Shell).
Go to the WAF Managed Rules configuration page: Security Settings > Policies > [Target Hostname] > WAF
Rule Management Modes
| Mode | Description | Use When |
|---|---|---|
| Automatic Mode | The rule set is automatically updated to the latest version without manual intervention | Most scenarios (recommended) |
| Manual Mode | Uses a fixed rule set version and requires manual confirmation and upgrade | Scenarios that require strict control over rule changes (finance, government, etc.) |
In Automatic Mode, the platform runs internal validation before each rule update and only pushes the update after minimizing the risk of false positives. If you are sensitive to rule changes, switch to Manual Mode to control the upgrade pace yourself.
Protection Modes
| Mode | Description |
|---|---|
| Log Mode | Detects requests and records logs without blocking. Used to verify whether rules produce false positives |
| Block Mode | When an attack request is detected, executes the configured action (e.g., Deny, Verification) |
Recommended workflow:
- For a newly onboarded hostname, first enable Log Mode and observe for 3–7 days
- Analyze the rules with high hit counts in Attack Logs and confirm there are no false positives
- Add exceptions for rules confirmed as false positives
- Switch to Block Mode
Why observe for 3–7 days instead of shorter?
This period is intended to cover a complete business cycle (weekdays + weekends). Traffic characteristics differ significantly across time periods; observing for only 1 day may miss legitimate business requests that only appear at specific times.
Rule Set Configuration
WAF rules are grouped by attack type, and you can configure the action for each group separately:
| Rule Group | Coverage | Recommended Action |
|---|---|---|
| SQL Injection Protection | SQL injection attacks | Deny |
| Cross-Site Scripting Protection | Cross-site scripting attacks | Deny |
| Command Injection | System command injection | Deny |
| File Inclusion | Path traversal, file inclusion | Deny |
| Scan Detection | Vulnerability scanner detection | Deny (or enable Scan Protection) |
| Other Rules | Deserialization, SSRF, etc. | Deny |
Controlling the Default Action for New Rules
When the rule set is upgraded, new rules use the platform-recommended action by default (usually Deny). If you are concerned that new rules may block legitimate business traffic before evaluation, you can set a unified default action for new rules before upgrading:
| Option | Behavior | Use When |
|---|---|---|
| Recommended | New rules use the platform-recommended action (current default) | You trust the platform recommendation without additional review |
| Log | New rules only record logs without blocking | You want to observe the traffic impact first and decide after evaluation |
| Not Used | New rules do not take effect until manually enabled | You require full manual control over each new rule |
You can also adjust the action for individual new rules (in the rule list on the upgrade page, use the dropdown selector in the Action After Upgrade column) to override the global default.
Recommended workflow:
- After receiving a rule set update notification, click View Update Details
- Based on business sensitivity, choose the default action for new rules (we recommend selecting Log on first use)
- If necessary, adjust the action for individual high-risk rules
- Confirm and then upgrade and deploy
- After the upgrade, monitor new rule hits in Attack Logs, and once confirmed, manually switch to Deny
Switching Rule Versions (Manual Mode)
If you use Manual Mode, after a new rule version is released:
- Click View Update Details to review the list of rules changed in the new version
- Evaluate whether the added or modified rules may affect your business
- Configure the default action for new rules
- Click Upgrade to Latest Version and deploy
- Immediately review Attack Logs after the upgrade to confirm there are no anomalies