# Distinguish a WAF rule match from the final anomaly-score action

> Interpret Application Gateway WAF match events together with policy mode and the aggregate request score.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:28:46+00:00
- Modified: 2026-09-10T00:55:36+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Interpret Application Gateway WAF match events together with policy mode and the aggregate request score.

## Potentially affected

Application Gateway WAF policies using managed-rule anomaly scoring.

## DSE recommendation

Review contributing rule matches and the final action for the same request before deciding what the WAF did.

## Article

## Source facts

In anomaly scoring, a rule match contributes to the request’s total. Microsoft’s example assigns five points to a Critical match and three to a Warning match. The match event itself is logged as Matched; it is not the final blocking decision.

At a total of five or more, a separate event records Blocked in Prevention mode or Detected in Detection mode. Microsoft identifies rule 949110 as an indication that the inbound anomaly score exceeded the threshold. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules).

## Applicability

Identify the Application Gateway WAF policy, managed ruleset, mode, and the request under investigation. Keep individual signature matches distinct from the aggregate action and from the application’s actual response.

## DSE recommendation

DSE recommends reviewing all related rule events before tuning a false positive. Record which matches contributed to the score and which final action occurred. Ask the application and security owners to assess the specific request; do not disable a broad threshold rule merely because its event is the last visible entry.

## Verification

Use approved harmless test requests that exercise known rule behavior in a test policy. Compare contributing matches, aggregate action, policy mode, and observed request handling. Check that the reporting pipeline does not label every Matched event as a blocked request. Retain sanitized request context and the reviewed policy version for reproducibility.

## Official references

[Microsoft Learn: CRS and DRS rule groups and rules](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules). Source retrieved September 9, 2026.

## Primary reference

- Name: CRS and DRS rule groups and rules - Azure Web Application Firewall | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Distinguish a WAF rule match from the final anomaly-score action,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-190-distinguish-a-waf-rule-match-from-the-final-anomaly-score-action/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.