Lesson 4.4: Tuning a WAF: the OWASP Core Rule Set
A web application firewall (WAF) inspects requests before they reach the application. ModSecurity with the OWASP Core Rule Set (CRS) is the open-source reference: many rules each add to an anomaly score, and a request is blocked when the score crosses a threshold. Untuned, it blocks legitimate work as well as attacks, and teams are tempted to switch it off. In the lab you read the WAF's audit log, separate real attacks from a false positive that stops editors from saving pages, and write a narrow rule exclusion instead of weakening the whole WAF.
17 min
You will learn to
- Explain WAFs and anomaly scoring
- Read ModSecurity JSON audit logs
- Tell false positives from true positives
- Write a narrow CRS rule exclusion
- Explain paranoia levels and detection-only rollout
Key terms
- WAF
- A filter in front of a web application that inspects HTTP requests (and sometimes responses).
- OWASP Core Rule Set (CRS)
- An open-source set of generic attack detection rules for ModSecurity-compatible WAFs.
- Anomaly scoring
- Each matching rule adds points (critical 5, error 4, warning 3, notice 2); the request is blocked above a threshold (default 5).
- Paranoia level
- PL1 to PL4: higher levels add stricter rules, more detections and more false positives.
- False positive
- Legitimate traffic flagged as an attack.
- Rule exclusion
- A rule that removes a specific check for a specific target, e.g. ctl:ruleRemoveTargetById.
← Protecting sessions and cookies · All lessons · DCSync and changes to privileged groups →