[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF1YAFNRWB2JE4V825KSEE":3,"skill-same:01M6AF1YAFNRWB2JE4V825KSEE":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6AF1YAFNRWB2JE4V825KSEE","implementing-cloud-waf-rules",null,"Deploys and tunes Web Application Firewall rules on AWS WAF, Azure WAF, and Cloudflare, covering managed rule sets, custom business-logic rules, rate limiting, bot management, and false-positive reduction. Use when deploying new apps behind a cloud WAF, when pentests reveal injection\u002FXSS flaws, when facing bot or credential-stuffing traffic, or when compliance (e.g. PCI-DSS) mandates a WAF.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-waf-rules\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing cloud waf rules","cloud","waf","firewall","azure-waf","cloud-waf","false-positive","xss","injection","cloudflare-waf","aws-waf","t1078","bot","owasp","cloud-security","cloudflare","pr","azure","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: implementing-cloud-waf-rules\ndescription: 'Deploys and tunes Web Application Firewall rules on AWS WAF, Azure WAF,\n  and Cloudflare, covering managed rule sets, custom business-logic rules, rate limiting,\n  bot management, and false-positive reduction. Use when deploying new apps behind\n  a cloud WAF, when pentests reveal injection\u002FXSS flaws, when facing bot or credential-stuffing\n  traffic, or when compliance (e.g. PCI-DSS) mandates a WAF.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-waf\n- aws-waf\n- azure-waf\n- cloudflare-waf\n- owasp-protection\n- rate-limiting\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n- T0816\n---\n\n# Implementing Cloud WAF Rules\n\n## When to Use\n\n- When deploying new web applications or APIs behind cloud load balancers requiring OWASP protection\n- When application penetration testing reveals SQL injection, XSS, or other injection vulnerabilities\n- When experiencing brute force, credential stuffing, or bot attacks against authentication endpoints\n- When compliance requirements mandate a WAF for PCI-DSS or similar standards\n- When tuning WAF rules to reduce false positives blocking legitimate application traffic\n\n**Do not use** for network-level DDoS protection (use AWS Shield or Azure DDoS Protection), for API authentication design (see managing-cloud-identity-with-okta), or for application code-level security fixes (WAF is a compensating control, not a replacement for secure code).\n\n## Prerequisites\n\n- AWS ALB\u002FCloudFront, Azure Application Gateway, or Cloudflare configured as the application entry point\n- Application traffic logs for baseline analysis before WAF deployment\n- Test environment for validating WAF rules before production enforcement\n- Understanding of application request patterns to minimize false positives\n\n## Workflow\n\n### Step 1: Deploy Managed Rule Sets\n\nEnable cloud provider managed rule sets that cover OWASP Top 10 vulnerabilities. Start in Count (detection) mode before switching to Block (prevention) mode.\n\n```bash\n# AWS WAF: Create Web ACL with AWS Managed Rules\naws wafv2 create-web-acl \\\n  --name production-waf \\\n  --scope REGIONAL \\\n  --default-action '{\"Allow\": {}}' \\\n  --visibility-config '{\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"production-waf\"\n  }' \\\n  --rules '[\n    {\n      \"Name\": \"AWSManagedRulesCommonRuleSet\",\n      \"Priority\": 1,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesCommonRuleSet\"\n        }\n      },\n      \"OverrideAction\": {\"Count\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"CommonRuleSet\"\n      }\n    },\n    {\n      \"Name\": \"AWSManagedRulesSQLiRuleSet\",\n      \"Priority\": 2,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesSQLiRuleSet\"\n        }\n      },\n      \"OverrideAction\": {\"Count\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"SQLiRuleSet\"\n      }\n    },\n    {\n      \"Name\": \"AWSManagedRulesKnownBadInputsRuleSet\",\n      \"Priority\": 3,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesKnownBadInputsRuleSet\"\n        }\n      },\n      \"OverrideAction\": {\"Count\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"KnownBadInputs\"\n      }\n    }\n  ]'\n```\n\n### Step 2: Create Custom Rate Limiting Rules\n\nDeploy rate-based rules to protect login endpoints against brute force and credential stuffing attacks.\n\n```bash\n# Rate limiting rule for login endpoint (100 requests per 5 minutes per IP)\naws wafv2 update-web-acl \\\n  --name production-waf \\\n  --scope REGIONAL \\\n  --id \u003Cweb-acl-id> \\\n  --lock-token \u003Clock-token> \\\n  --default-action '{\"Allow\": {}}' \\\n  --rules '[\n    {\n      \"Name\": \"RateLimitLogin\",\n      \"Priority\": 0,\n      \"Statement\": {\n        \"RateBasedStatement\": {\n          \"Limit\": 100,\n          \"AggregateKeyType\": \"IP\",\n          \"ScopeDownStatement\": {\n            \"ByteMatchStatement\": {\n              \"FieldToMatch\": {\"UriPath\": {}},\n              \"PositionalConstraint\": \"STARTS_WITH\",\n              \"SearchString\": \"\u002Fapi\u002Fauth\u002Flogin\",\n              \"TextTransformations\": [{\"Priority\": 0, \"Type\": \"LOWERCASE\"}]\n            }\n          }\n        }\n      },\n      \"Action\": {\"Block\": {\"CustomResponse\": {\"ResponseCode\": 429}}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"RateLimitLogin\"\n      }\n    }\n  ]'\n```\n\n### Step 3: Configure Geo-Blocking and IP Reputation\n\nBlock traffic from countries where the application has no legitimate users and leverage IP reputation lists to block known malicious sources.\n\n```bash\n# AWS WAF: Geo-blocking rule\n# Block countries not in the allowed list\naws wafv2 create-ip-set \\\n  --name blocked-ips \\\n  --scope REGIONAL \\\n  --ip-address-version IPV4 \\\n  --addresses \"198.51.100.0\u002F24\" \"203.0.113.0\u002F24\"\n\n# Add Amazon IP Reputation rule\n# AWSManagedRulesAmazonIpReputationList blocks IPs flagged by AWS threat intelligence\n```\n\n### Step 4: Tune Rules to Reduce False Positives\n\nAnalyze WAF logs in Count mode to identify legitimate requests being flagged. Create rule exceptions for specific URI paths or request patterns.\n\n```bash\n# Enable WAF logging to S3\naws wafv2 put-logging-configuration \\\n  --logging-configuration '{\n    \"ResourceArn\": \"arn:aws:wafv2:us-east-1:123456789012:regional\u002Fwebacl\u002Fproduction-waf\u002Fid\",\n    \"LogDestinationConfigs\": [\"arn:aws:s3:::waf-logs-bucket\"],\n    \"RedactedFields\": [{\"SingleHeader\": {\"Name\": \"authorization\"}}]\n  }'\n\n# Query WAF logs with Athena to find false positives\n# Find rules triggered most frequently for legitimate traffic\ncat \u003C\u003C 'EOF' > waf-analysis.sql\nSELECT\n  terminatingRuleId,\n  httpRequest.uri,\n  httpRequest.httpMethod,\n  COUNT(*) as block_count\nFROM waf_logs\nWHERE action = 'BLOCK'\n  AND timestamp > date_add('day', -7, now())\nGROUP BY terminatingRuleId, httpRequest.uri, httpRequest.httpMethod\nORDER BY block_count DESC\nLIMIT 20\nEOF\n```\n\n```bash\n# Exclude specific rule from managed rule set that causes false positives\n# Example: Exclude SizeRestrictions_BODY for file upload endpoint\naws wafv2 update-web-acl \\\n  --name production-waf \\\n  --scope REGIONAL \\\n  --id \u003Cweb-acl-id> \\\n  --lock-token \u003Clock-token> \\\n  --rules '[{\n    \"Name\": \"AWSManagedRulesCommonRuleSet\",\n    \"Priority\": 1,\n    \"Statement\": {\n      \"ManagedRuleGroupStatement\": {\n        \"VendorName\": \"AWS\",\n        \"Name\": \"AWSManagedRulesCommonRuleSet\",\n        \"ExcludedRules\": [{\"Name\": \"SizeRestrictions_BODY\"}]\n      }\n    },\n    \"OverrideAction\": {\"None\": {}},\n    \"VisibilityConfig\": {\n      \"SampledRequestsEnabled\": true,\n      \"CloudWatchMetricsEnabled\": true,\n      \"MetricName\": \"CommonRuleSet\"\n    }\n  }]'\n```\n\n### Step 5: Switch to Block Mode After Validation\n\nAfter 7-14 days of Count mode with acceptable false positive rates, switch managed rules to Block mode for active protection.\n\n```bash\n# Change OverrideAction from Count to None (use rule group's default Block action)\n# Update each managed rule group from {\"Count\": {}} to {\"None\": {}}\n# Monitor CloudWatch metrics for sudden changes in blocked request volume\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Web ACL | Web Access Control List defining the set of rules evaluated against every HTTP request to a protected resource |\n| Managed Rule Group | Pre-configured rule set maintained by the cloud provider or third-party vendor covering common attack patterns |\n| Rate-Based Rule | WAF rule that tracks request rates per IP address and blocks IPs exceeding the threshold within a time window |\n| Count Mode | WAF action that logs matching requests without blocking them, used for rule validation before enforcement |\n| Rule Priority | Numerical ordering determining which rules are evaluated first; lower numbers have higher priority |\n| Custom Response | WAF capability to return specific HTTP status codes and headers when blocking requests |\n| Scope-Down Statement | Condition that narrows a rate-based rule to specific URI paths, methods, or headers |\n| False Positive | Legitimate request incorrectly blocked by a WAF rule, requiring rule tuning or exclusion |\n\n## Tools & Systems\n\n- **AWS WAF**: Cloud-native WAF integrated with ALB, CloudFront, API Gateway, and AppSync\n- **Azure WAF**: Web application firewall on Application Gateway or Front Door with OWASP CRS rule sets\n- **AWS Firewall Manager**: Centralized WAF policy management across multiple AWS accounts in an Organization\n- **WAF Security Automations**: AWS solution that deploys Lambda-based automated WAF rule updates based on log analysis\n- **CloudWatch Metrics**: Monitoring dashboard for tracking WAF rule match rates, block counts, and allowed requests\n\n## Common Scenarios\n\n### Scenario: Credential Stuffing Attack Against Authentication API\n\n**Context**: An e-commerce application experiences 50,000 login attempts per hour from a botnet using stolen credential lists. The attacker rotates source IPs every few minutes to evade simple IP-based blocking.\n\n**Approach**:\n1. Deploy rate-based rules limiting login endpoint requests to 10 per 5 minutes per IP\n2. Enable AWS WAF Bot Control managed rule group to detect automated request patterns beyond IP rotation\n3. Add a custom rule requiring valid CAPTCHA tokens for login requests exceeding 5 failures\n4. Implement IP reputation blocking using AWSManagedRulesAmazonIpReputationList\n5. Create a custom rule matching on User-Agent patterns common to credential stuffing tools\n6. Monitor blocked request metrics and adjust thresholds based on legitimate traffic patterns\n\n**Pitfalls**: Setting rate limits too aggressively blocks legitimate users behind shared NAT IPs. Blocking by User-Agent alone is easily bypassed by rotating agent strings.\n\n## Output Format\n\n```text\nCloud WAF Configuration Report\n================================\nWeb ACL: production-waf\nScope: Regional (us-east-1)\nProtected Resources: ALB (arn:aws:elasticloadbalancing:...)\nReport Date: 2025-02-23\n\nRULE CONFIGURATION:\n  [P0] RateLimitLogin          - BLOCK (100 req\u002F5min\u002FIP)\n  [P1] AWSManagedRulesCommon   - BLOCK (1 exclusion: SizeRestrictions_BODY)\n  [P2] AWSManagedRulesSQLi     - BLOCK\n  [P3] AWSManagedRulesKnownBad - BLOCK\n  [P4] AWSManagedRulesBotControl - COUNT (evaluation phase)\n  [P5] GeoBlockRule            - BLOCK (12 countries blocked)\n\nTRAFFIC ANALYSIS (Last 7 Days):\n  Total Requests:    2,847,293\n  Allowed:           2,791,456 (98.0%)\n  Blocked:              51,234 (1.8%)\n  Counted:               4,603 (0.2%)\n\nTOP BLOCKED RULES:\n  RateLimitLogin:              23,456 blocks (45.8%)\n  SQLi Detection:               8,234 blocks (16.1%)\n  CommonRuleSet (XSS):          7,891 blocks (15.4%)\n  GeoBlockRule:                 6,543 blocks (12.8%)\n  KnownBadInputs:              5,110 blocks (10.0%)\n\nFALSE POSITIVE ANALYSIS:\n  Reported False Positives: 3\n  Confirmed False Positives: 1 (SizeRestrictions_BODY for \u002Fapi\u002Fupload)\n  Action Taken: Rule exclusion applied\n```\n","# Implementing Cloud WAF Rules\n\n## When to Use\n\n- When deploying new web applications or APIs behind cloud load balancers requiring OWASP protection\n- When application penetration testing reveals SQL injection, XSS, or other injection vulnerabilities\n- When experiencing brute force, credential stuffing, or bot attacks against authentication endpoints\n- When compliance requirements mandate a WAF for PCI-DSS or similar standards\n- When tuning WAF rules to reduce false positives blocking legitimate application traffic\n\n**Do not use** for network-level DDoS protection (use AWS Shield or Azure DDoS Protection), for API authentication design (see managing-cloud-identity-with-okta), or for application code-level security fixes (WAF is a compensating control, not a replacement for secure code).\n\n## Prerequisites\n\n- AWS ALB\u002FCloudFront, Azure Application Gateway, or Cloudflare configured as the application entry point\n- Application traffic logs for baseline analysis before WAF deployment\n- Test environment for validating WAF rules before production enforcement\n- Understanding of application request patterns to minimize false positives\n\n## Workflow\n\n### Step 1: Deploy Managed Rule Sets\n\nEnable cloud provider managed rule sets that cover OWASP Top 10 vulnerabilities. Start in Count (detection) mode before switching to Block (prevention) mode.\n\n```bash\n# AWS WAF: Create Web ACL with AWS Managed Rules\naws wafv2 create-web-acl \\\n  --name production-waf \\\n  --scope REGIONAL \\\n  --default-action '{\"Allow\": {}}' \\\n  --visibility-config '{\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"production-waf\"\n  }' \\\n  --rules '[\n    {\n      \"Name\": \"AWSManagedRulesCommonRuleSet\",\n      \"Priority\": 1,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesCommonRuleSet\"\n        }\n      },\n      \"OverrideAction\": {\"Count\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"CommonRuleSet\"\n      }\n    },\n    {\n      \"Name\": \"AWSManagedRulesSQLiRuleSet\",\n      \"Priority\": 2,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesSQLiRuleSet\"\n        }\n      },\n      \"OverrideAction\": {\"Count\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"SQLiRuleSet\"\n      }\n    },\n    {\n      \"Name\": \"AWSManagedRulesKnownBadInputsRuleSet\",\n      \"Priority\": 3,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesKnownBadInputsRuleSet\"\n        }\n      },\n      \"OverrideAction\": {\"Count\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"KnownBadInputs\"\n      }\n    }\n  ]'\n```\n\n### Step 2: Create Custom Rate Limiting Rules\n\nDeploy rate-based rules to protect login endpoints against brute force and credential stuffing attacks.\n\n```bash\n# Rate limiting rule for login endpoint (100 requests per 5 minutes per IP)\naws wafv2 update-web-acl \\\n  --name production-waf \\\n  --scope REGIONAL \\\n  --id \u003Cweb-acl-id> \\\n  --lock-token \u003Clock-token> \\\n  --default-action '{\"Allow\": {}}' \\\n  --rules '[\n    {\n      \"Name\": \"RateLimitLogin\",\n      \"Priority\": 0,\n      \"Statement\": {\n        \"RateBasedStatement\": {\n          \"Limit\": 100,\n          \"AggregateKeyType\": \"IP\",\n          \"ScopeDownStatement\": {\n            \"ByteMatchStatement\": {\n              \"FieldToMatch\": {\"UriPath\": {}},\n              \"PositionalConstraint\": \"STARTS_WITH\",\n              \"SearchString\": \"\u002Fapi\u002Fauth\u002Flogin\",\n              \"TextTransformations\": [{\"Priority\": 0, \"Type\": \"LOWERCASE\"}]\n            }\n          }\n        }\n      },\n      \"Action\": {\"Block\": {\"CustomResponse\": {\"ResponseCode\": 429}}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"RateLimitLogin\"\n      }\n    }\n  ]'\n```\n\n### Step 3: Configure Geo-Blocking and IP Reputation\n\nBlock traffic from countries where the application has no legitimate users and leverage IP reputation lists to block known malicious sources.\n\n```bash\n# AWS WAF: Geo-blocking rule\n# Block countries not in the allowed list\naws wafv2 create-ip-set \\\n  --name blocked-ips \\\n  --scope REGIONAL \\\n  --ip-address-version IPV4 \\\n  --addresses \"198.51.100.0\u002F24\" \"203.0.113.0\u002F24\"\n\n# Add Amazon IP Reputation rule\n# AWSManagedRulesAmazonIpReputationList blocks IPs flagged by AWS threat intelligence\n```\n\n### Step 4: Tune Rules to Reduce False Positives\n\nAnalyze WAF logs in Count mode to identify legitimate requests being flagged. Create rule exceptions for specific URI paths or request patterns.\n\n```bash\n# Enable WAF logging to S3\naws wafv2 put-logging-configuration \\\n  --logging-configuration '{\n    \"ResourceArn\": \"arn:aws:wafv2:us-east-1:123456789012:regional\u002Fwebacl\u002Fproduction-waf\u002Fid\",\n    \"LogDestinationConfigs\": [\"arn:aws:s3:::waf-logs-bucket\"],\n    \"RedactedFields\": [{\"SingleHeader\": {\"Name\": \"authorization\"}}]\n  }'\n\n# Query WAF logs with Athena to find false positives\n# Find rules triggered most frequently for legitimate traffic\ncat \u003C\u003C 'EOF' > waf-analysis.sql\nSELECT\n  terminatingRuleId,\n  httpRequest.uri,\n  httpRequest.httpMethod,\n  COUNT(*) as block_count\nFROM waf_logs\nWHERE action = 'BLOCK'\n  AND timestamp > date_add('day', -7, now())\nGROUP BY terminatingRuleId, httpRequest.uri, httpRequest.httpMethod\nORDER BY block_count DESC\nLIMIT 20\nEOF\n```\n\n```bash\n# Exclude specific rule from managed rule set that causes false positives\n# Example: Exclude SizeRestrictions_BODY for file upload endpoint\naws wafv2 update-web-acl \\\n  --name production-waf \\\n  --scope REGIONAL \\\n  --id \u003Cweb-acl-id> \\\n  --lock-token \u003Clock-token> \\\n  --rules '[{\n    \"Name\": \"AWSManagedRulesCommonRuleSet\",\n    \"Priority\": 1,\n    \"Statement\": {\n      \"ManagedRuleGroupStatement\": {\n        \"VendorName\": \"AWS\",\n        \"Name\": \"AWSManagedRulesCommonRuleSet\",\n        \"ExcludedRules\": [{\"Name\": \"SizeRestrictions_BODY\"}]\n      }\n    },\n    \"OverrideAction\": {\"None\": {}},\n    \"VisibilityConfig\": {\n      \"SampledRequestsEnabled\": true,\n      \"CloudWatchMetricsEnabled\": true,\n      \"MetricName\": \"CommonRuleSet\"\n    }\n  }]'\n```\n\n### Step 5: Switch to Block Mode After Validation\n\nAfter 7-14 days of Count mode with acceptable false positive rates, switch managed rules to Block mode for active protection.\n\n```bash\n# Change OverrideAction from Count to None (use rule group's default Block action)\n# Update each managed rule group from {\"Count\": {}} to {\"None\": {}}\n# Monitor CloudWatch metrics for sudden changes in blocked request volume\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Web ACL | Web Access Control List defining the set of rules evaluated against every HTTP request to a protected resource |\n| Managed Rule Group | Pre-configured rule set maintained by the cloud provider or third-party vendor covering common attack patterns |\n| Rate-Based Rule | WAF rule that tracks request rates per IP address and blocks IPs exceeding the threshold within a time window |\n| Count Mode | WAF action that logs matching requests without blocking them, used for rule validation before enforcement |\n| Rule Priority | Numerical ordering determining which rules are evaluated first; lower numbers have higher priority |\n| Custom Response | WAF capability to return specific HTTP status codes and headers when blocking requests |\n| Scope-Down Statement | Condition that narrows a rate-based rule to specific URI paths, methods, or headers |\n| False Positive | Legitimate request incorrectly blocked by a WAF rule, requiring rule tuning or exclusion |\n\n## Tools & Systems\n\n- **AWS WAF**: Cloud-native WAF integrated with ALB, CloudFront, API Gateway, and AppSync\n- **Azure WAF**: Web application firewall on Application Gateway or Front Door with OWASP CRS rule sets\n- **AWS Firewall Manager**: Centralized WAF policy management across multiple AWS accounts in an Organization\n- **WAF Security Automations**: AWS solution that deploys Lambda-based automated WAF rule updates based on log analysis\n- **CloudWatch Metrics**: Monitoring dashboard for tracking WAF rule match rates, block counts, and allowed requests\n\n## Common Scenarios\n\n### Scenario: Credential Stuffing Attack Against Authentication API\n\n**Context**: An e-commerce application experiences 50,000 login attempts per hour from a botnet using stolen credential lists. The attacker rotates source IPs every few minutes to evade simple IP-based blocking.\n\n**Approach**:\n1. Deploy rate-based rules limiting login endpoint requests to 10 per 5 minutes per IP\n2. Enable AWS WAF Bot Control managed rule group to detect automated request patterns beyond IP rotation\n3. Add a custom rule requiring valid CAPTCHA tokens for login requests exceeding 5 failures\n4. Implement IP reputation blocking using AWSManagedRulesAmazonIpReputationList\n5. Create a custom rule matching on User-Agent patterns common to credential stuffing tools\n6. Monitor blocked request metrics and adjust thresholds based on legitimate traffic patterns\n\n**Pitfalls**: Setting rate limits too aggressively blocks legitimate users behind shared NAT IPs. Blocking by User-Agent alone is easily bypassed by rotating agent strings.\n\n## Output Format\n\n```text\nCloud WAF Configuration Report\n================================\nWeb ACL: production-waf\nScope: Regional (us-east-1)\nProtected Resources: ALB (arn:aws:elasticloadbalancing:...)\nReport Date: 2025-02-23\n\nRULE CONFIGURATION:\n  [P0] RateLimitLogin          - BLOCK (100 req\u002F5min\u002FIP)\n  [P1] AWSManagedRulesCommon   - BLOCK (1 exclusion: SizeRestrictions_BODY)\n  [P2] AWSManagedRulesSQLi     - BLOCK\n  [P3] AWSManagedRulesKnownBad - BLOCK\n  [P4] AWSManagedRulesBotControl - COUNT (evaluation phase)\n  [P5] GeoBlockRule            - BLOCK (12 countries blocked)\n\nTRAFFIC ANALYSIS (Last 7 Days):\n  Total Requests:    2,847,293\n  Allowed:           2,791,456 (98.0%)\n  Blocked:              51,234 (1.8%)\n  Counted:               4,603 (0.2%)\n\nTOP BLOCKED RULES:\n  RateLimitLogin:              23,456 blocks (45.8%)\n  SQLi Detection:               8,234 blocks (16.1%)\n  CommonRuleSet (XSS):          7,891 blocks (15.4%)\n  GeoBlockRule:                 6,543 blocks (12.8%)\n  KnownBadInputs:              5,110 blocks (10.0%)\n\nFALSE POSITIVE ANALYSIS:\n  Reported False Positives: 3\n  Confirmed False Positives: 1 (SizeRestrictions_BODY for \u002Fapi\u002Fupload)\n  Action Taken: Rule exclusion applied\n```\n",{"name":5,"tags":49,"author":52,"domain":42,"license":15,"version":53,"nist_csf":54,"subdomain":38,"description":59,"mitre_attack":60},[29,34,28,33,50,51],"owasp-protection","rate-limiting","mahipal","1.0.0",[55,56,57,58],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Deploys and tunes Web Application Firewall rules on AWS WAF, Azure WAF, and Cloudflare, covering managed rule sets, custom business-logic rules, rate limiting, bot management, and false-positive reduction. Use when deploying new apps behind a cloud WAF, when pentests reveal injection\u002FXSS flaws, when facing bot or credential-stuffing traffic, or when compliance (e.g. PCI-DSS) mandates a WAF.\n",[61,62,63,64,65],"T1078.004","T1530","T1537","T1580","T0816","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-cloud-waf-rules",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cloud-waf-rules",{"tool":82,"command":83},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cloud-waf-rules",{"tool":85,"command":86},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cloud-waf-rules","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-waf-rules\u002FSKILL.md",true,[90,95,101],{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-waf-rules\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",2347,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-waf-rules\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fagent.py","SCRIPT","脚本",8429,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-waf-rules\u002Fscripts\u002Fagent.py",[108,133,157,184,210,237],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":115,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[114],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[116,117,118,119,43,42,120,121,40,122,123,124,125,126,127,128,129,130,131,132],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[139],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[141,129,142,143,43,144,42,40,145,146,147,148,149,150,151,152,153,154,155,156],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":167,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[163,166],{"categoryNo":164,"categoryName":165,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[151,168,169,170,171,42,172,173,145,174,175,176,177,178,179,35,180,181,182,183],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":191,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[190],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[192,193,194,42,195,196,197,198,199,200,201,202,203,204,205,206,148,207,208,209],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":217,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[216],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[218,219,220,42,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":244,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[243],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[43,245,42,246,247,248,249,250,251,252,253,35,254,180,255,256,257,258,259,260],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]