WAF Policies

VNetArmor custom WAF rules use a readable DSL. Rules can allow, block, log, check, or set defaults depending on supported policy mode.

Basic syntax

default ALLOW

rule <id> <ALLOW|BLOCK|LOG|CHECK|DEFAULT> priority <number> [chain continue]
when <all|any|not>
  match <field> /regex/i
  exists <field>
end
end

Common fields

Field	Purpose
http.method	HTTP method.
http.host	Host header.
http.path	Normalized path.
http.target	Request target.
http.raw_target	Raw request target.
http.query	Query string.
http.decoded_query	Decoded query string.
http.decoded_path	Decoded path.
http.decoded_target	Decoded target.
http.header:<Name>	Header value.
http.body	Request body prefix available for inspection.
http.content_type	Content-Type header.

Example rules

rule waf_health_allow ALLOW priority 1000
when any
  match http.path /^\/health$/
  match http.path /^\/ready$/
end
end

rule waf_bad_methods BLOCK priority 980
when any
  match http.method /^(TRACE|TRACK|CONNECT)$/i
end
end

rule waf_sqli_union_select BLOCK priority 940
when any
  match http.query /union\s+select/i
  match http.decoded_target /union\s+select/i
end
end

Rule ordering

Use higher priorities for health checks and high-confidence security blocks. Use LOG or CHECK before enforcing new rules against production traffic.

Best practices

• Keep rule IDs stable.
• Avoid overly broad regular expressions.
• Test high-risk rules with representative traffic.
• Inspect logs for false positives before switching from log/check to block.