{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion/", "slug": "dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion", "url": "https://update.dsesecurity.com/updates/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion/" }, "title": "Do not use a selector label to narrow a WAF EqualsAny exclusion", "summary": "Application Gateway replaces the selector with an asterisk when an EqualsAny exclusion is created.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:22:35+00:00", "modified_at": "2026-09-10T02:14:31+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 234, "potentially_affected": "Application Gateway v2 WAF policy exclusion reviews.", "dse_recommendation": "Review the exclusion operator, persisted selector and rule scope together before approving it.", "primary_source": { "name": "WAF Exclusion Lists in Azure Application Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For an exclusion using EqualsAny, the Application Gateway backend converts any supplied selector to an asterisk. That operator selects all fields for the chosen match variable; a specific-looking value entered in the selector does not narrow it.

\n

Exclusions can apply to a particular rule, rule group, ruleset or all rules. Microsoft recommends narrow exclusions and per-rule scope where possible. The match variable also determines whether a request key or its value is excluded from evaluation. Microsoft Learn.

\n

Applicability

\n

Identify the managed rule producing the false positive and the exact request attribute involved. Check the deployed policy, not only the intended selector in a change request.

\n

DSE recommendation

\n

DSE recommends choosing the smallest supported selector and rule scope that addresses the established false positive. Do not approve EqualsAny on the assumption that a descriptive selector limits it to one attribute. Have the application and security owners review neighboring fields that would otherwise lose evaluation. Preserve the reason and review trigger for the exception.

\n

Verification

\n

Inspect the saved exclusion operator and selector after an authorized change. Test the intended benign request and suitable neighboring cases in an approved environment to confirm the exception’s actual boundary. Review rule evaluation evidence rather than relying only on request success. Reconcile a persisted asterisk with the approved scope before enabling the exception more broadly.

\n

Official references

\n

Microsoft Learn: WAF Exclusion Lists in Azure Application Gateway. Source retrieved September 9, 2026.

", "content_text": "Source facts\nFor an exclusion using EqualsAny, the Application Gateway backend converts any supplied selector to an asterisk. That operator selects all fields for the chosen match variable; a specific-looking value entered in the selector does not narrow it.\nExclusions can apply to a particular rule, rule group, ruleset or all rules. Microsoft recommends narrow exclusions and per-rule scope where possible. The match variable also determines whether a request key or its value is excluded from evaluation. Microsoft Learn.\nApplicability\nIdentify the managed rule producing the false positive and the exact request attribute involved. Check the deployed policy, not only the intended selector in a change request.\nDSE recommendation\nDSE recommends choosing the smallest supported selector and rule scope that addresses the established false positive. Do not approve EqualsAny on the assumption that a descriptive selector limits it to one attribute. Have the application and security owners review neighboring fields that would otherwise lose evaluation. Preserve the reason and review trigger for the exception.\nVerification\nInspect the saved exclusion operator and selector after an authorized change. Test the intended benign request and suitable neighboring cases in an approved environment to confirm the exception’s actual boundary. Review rule evaluation evidence rather than relying only on request success. Reconcile a persisted asterisk with the approved scope before enabling the exception more broadly.\nOfficial references\nMicrosoft Learn: WAF Exclusion Lists in Azure Application Gateway. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nFor an exclusion using EqualsAny, the Application Gateway backend converts any supplied selector to an asterisk. That operator selects all fields for the chosen match variable; a specific-looking value entered in the selector does not narrow it.\n\nExclusions can apply to a particular rule, rule group, ruleset or all rules. Microsoft recommends narrow exclusions and per-rule scope where possible. The match variable also determines whether a request key or its value is excluded from evaluation. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration).\n\n## Applicability\n\nIdentify the managed rule producing the false positive and the exact request attribute involved. Check the deployed policy, not only the intended selector in a change request.\n\n## DSE recommendation\n\nDSE recommends choosing the smallest supported selector and rule scope that addresses the established false positive. Do not approve EqualsAny on the assumption that a descriptive selector limits it to one attribute. Have the application and security owners review neighboring fields that would otherwise lose evaluation. Preserve the reason and review trigger for the exception.\n\n## Verification\n\nInspect the saved exclusion operator and selector after an authorized change. Test the intended benign request and suitable neighboring cases in an approved environment to confirm the exception’s actual boundary. Review rule evaluation evidence rather than relying only on request success. Reconcile a persisted asterisk with the approved scope before enabling the exception more broadly.\n\n## Official references\n\n[Microsoft Learn: WAF Exclusion Lists in Azure Application Gateway](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion/", "url": "https://update.dsesecurity.com/updates/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not use a selector label to narrow a WAF EqualsAny exclusion", "item": "https://update.dsesecurity.com/updates/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion/", "url": "https://update.dsesecurity.com/updates/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion/", "headline": "Do not use a selector label to narrow a WAF EqualsAny exclusion", "description": "Application Gateway replaces the selector with an asterisk when an EqualsAny exclusion is created.", "abstract": "Application Gateway replaces the selector with an asterisk when an EqualsAny exclusion is created.", "articleBody": "Source facts\nFor an exclusion using EqualsAny, the Application Gateway backend converts any supplied selector to an asterisk. That operator selects all fields for the chosen match variable; a specific-looking value entered in the selector does not narrow it.\nExclusions can apply to a particular rule, rule group, ruleset or all rules. Microsoft recommends narrow exclusions and per-rule scope where possible. The match variable also determines whether a request key or its value is excluded from evaluation. Microsoft Learn.\nApplicability\nIdentify the managed rule producing the false positive and the exact request attribute involved. Check the deployed policy, not only the intended selector in a change request.\nDSE recommendation\nDSE recommends choosing the smallest supported selector and rule scope that addresses the established false positive. Do not approve EqualsAny on the assumption that a descriptive selector limits it to one attribute. Have the application and security owners review neighboring fields that would otherwise lose evaluation. Preserve the reason and review trigger for the exception.\nVerification\nInspect the saved exclusion operator and selector after an authorized change. Test the intended benign request and suitable neighboring cases in an approved environment to confirm the exception’s actual boundary. Review rule evaluation evidence rather than relying only on request success. Reconcile a persisted asterisk with the approved scope before enabling the exception more broadly.\nOfficial references\nMicrosoft Learn: WAF Exclusion Lists in Azure Application Gateway. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:22:35+00:00", "dateModified": "2026-09-10T02:14:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-561-do-not-use-a-selector-label-to-narrow-a-waf-equalsany-exclusion/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not use a selector label to narrow a WAF EqualsAny exclusion" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 234, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "WAF Exclusion Lists in Azure Application Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration" } } ] } }