{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/", "slug": "dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action", "url": "https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/" }, "title": "Distinguish a WAF rule match from the final anomaly-score action", "summary": "Interpret Application Gateway WAF match events together with policy mode and the aggregate request score.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:46+00:00", "modified_at": "2026-09-10T00:55:36+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 228, "potentially_affected": "Application Gateway WAF policies using managed-rule anomaly scoring.", "dse_recommendation": "Review contributing rule matches and the final action for the same request before deciding what the WAF did.", "primary_source": { "name": "CRS and DRS rule groups and rules - Azure Web Application Firewall | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

In anomaly scoring, a rule match contributes to the request’s total. Microsoft’s example assigns five points to a Critical match and three to a Warning match. The match event itself is logged as Matched; it is not the final blocking decision.

\n

At a total of five or more, a separate event records Blocked in Prevention mode or Detected in Detection mode. Microsoft identifies rule 949110 as an indication that the inbound anomaly score exceeded the threshold. Microsoft Learn.

\n

Applicability

\n

Identify the Application Gateway WAF policy, managed ruleset, mode, and the request under investigation. Keep individual signature matches distinct from the aggregate action and from the application’s actual response.

\n

DSE recommendation

\n

DSE recommends reviewing all related rule events before tuning a false positive. Record which matches contributed to the score and which final action occurred. Ask the application and security owners to assess the specific request; do not disable a broad threshold rule merely because its event is the last visible entry.

\n

Verification

\n

Use approved harmless test requests that exercise known rule behavior in a test policy. Compare contributing matches, aggregate action, policy mode, and observed request handling. Check that the reporting pipeline does not label every Matched event as a blocked request. Retain sanitized request context and the reviewed policy version for reproducibility.

\n

Official references

\n

Microsoft Learn: CRS and DRS rule groups and rules. Source retrieved September 9, 2026.

", "content_text": "Source facts\nIn anomaly scoring, a rule match contributes to the request’s total. Microsoft’s example assigns five points to a Critical match and three to a Warning match. The match event itself is logged as Matched; it is not the final blocking decision.\nAt a total of five or more, a separate event records Blocked in Prevention mode or Detected in Detection mode. Microsoft identifies rule 949110 as an indication that the inbound anomaly score exceeded the threshold. Microsoft Learn.\nApplicability\nIdentify the Application Gateway WAF policy, managed ruleset, mode, and the request under investigation. Keep individual signature matches distinct from the aggregate action and from the application’s actual response.\nDSE recommendation\nDSE recommends reviewing all related rule events before tuning a false positive. Record which matches contributed to the score and which final action occurred. Ask the application and security owners to assess the specific request; do not disable a broad threshold rule merely because its event is the last visible entry.\nVerification\nUse approved harmless test requests that exercise known rule behavior in a test policy. Compare contributing matches, aggregate action, policy mode, and observed request handling. Check that the reporting pipeline does not label every Matched event as a blocked request. Retain sanitized request context and the reviewed policy version for reproducibility.\nOfficial references\nMicrosoft Learn: CRS and DRS rule groups and rules. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nIn anomaly scoring, a rule match contributes to the request’s total. Microsoft’s example assigns five points to a Critical match and three to a Warning match. The match event itself is logged as Matched; it is not the final blocking decision.\n\nAt a total of five or more, a separate event records Blocked in Prevention mode or Detected in Detection mode. Microsoft identifies rule 949110 as an indication that the inbound anomaly score exceeded the threshold. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules).\n\n## Applicability\n\nIdentify the Application Gateway WAF policy, managed ruleset, mode, and the request under investigation. Keep individual signature matches distinct from the aggregate action and from the application’s actual response.\n\n## DSE recommendation\n\nDSE recommends reviewing all related rule events before tuning a false positive. Record which matches contributed to the score and which final action occurred. Ask the application and security owners to assess the specific request; do not disable a broad threshold rule merely because its event is the last visible entry.\n\n## Verification\n\nUse approved harmless test requests that exercise known rule behavior in a test policy. Compare contributing matches, aggregate action, policy mode, and observed request handling. Check that the reporting pipeline does not label every Matched event as a blocked request. Retain sanitized request context and the reviewed policy version for reproducibility.\n\n## Official references\n\n[Microsoft Learn: CRS and DRS rule groups and rules](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/", "url": "https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Distinguish a WAF rule match from the final anomaly-score action", "item": "https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/", "url": "https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/", "headline": "Distinguish a WAF rule match from the final anomaly-score action", "description": "Interpret Application Gateway WAF match events together with policy mode and the aggregate request score.", "abstract": "Interpret Application Gateway WAF match events together with policy mode and the aggregate request score.", "articleBody": "Source facts\nIn anomaly scoring, a rule match contributes to the request’s total. Microsoft’s example assigns five points to a Critical match and three to a Warning match. The match event itself is logged as Matched; it is not the final blocking decision.\nAt a total of five or more, a separate event records Blocked in Prevention mode or Detected in Detection mode. Microsoft identifies rule 949110 as an indication that the inbound anomaly score exceeded the threshold. Microsoft Learn.\nApplicability\nIdentify the Application Gateway WAF policy, managed ruleset, mode, and the request under investigation. Keep individual signature matches distinct from the aggregate action and from the application’s actual response.\nDSE recommendation\nDSE recommends reviewing all related rule events before tuning a false positive. Record which matches contributed to the score and which final action occurred. Ask the application and security owners to assess the specific request; do not disable a broad threshold rule merely because its event is the last visible entry.\nVerification\nUse approved harmless test requests that exercise known rule behavior in a test policy. Compare contributing matches, aggregate action, policy mode, and observed request handling. Check that the reporting pipeline does not label every Matched event as a blocked request. Retain sanitized request context and the reviewed policy version for reproducibility.\nOfficial references\nMicrosoft Learn: CRS and DRS rule groups and rules. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:28:46+00:00", "dateModified": "2026-09-10T00:55:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Distinguish a WAF rule match from the final anomaly-score action" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 228, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "CRS and DRS rule groups and rules - Azure Web Application Firewall | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules" } } ] } }