如何确定影响我特定 url 的 Azure WAF 规则

Question

当访问 url 这样的格式时，我的请求得到了 403 https://example.com/Test.aspx?param=https%3A%2F%2Fwww.test.com%2Fen-us%3F

我已阅读 the document 但我不确定哪个规则阻止了我的请求。

任何人都可以告诉我：

如何准确找到阻止我的请求的规则
报告请求被阻止（我查看了日志但里面什么都没有）

Answer 1

如果您启用了WAF monitoring for application gateway or for Azure front door, you should see the ruleId in the Firewall log. Please note that the logs are only saved hourly. You could get more details from this blog。

{
  "resourceId": "/SUBSCRIPTIONS/{subscriptionId}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/APPLICATIONGATEWAYS/{applicationGatewayName}",
  "operationName": "ApplicationGatewayFirewall",
  "time": "2017-03-20T15:52:09.1494499Z",
  "category": "ApplicationGatewayFirewallLog",
  "properties": {
    "instanceId": "ApplicationGatewayRole_IN_0",
    "clientIp": "104.210.252.3",
    "clientPort": "4835",
    "requestUri": "/?a=%3Cscript%3Ealert(%22Hello%22);%3C/script%3E",
    "ruleSetType": "OWASP",
    "ruleSetVersion": "3.0",
    "ruleId": "941320",
    "message": "Possible XSS Attack Detected - HTML Tag Handler",
    "action": "Blocked",
    "site": "Global",
    "details": {
      "message": "Warning. Pattern match \"<(a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|em|embed|fieldset|fn|font|form|frame|frameset|h1|head|h ...\" at ARGS:a.",
      "data": "Matched Data: <script> found within ARGS:a: <script>alert(\x22hello\x22);</script>",
      "file": "rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf",
      "line": "865"
    }
    "hostname": "40.90.218.100", 
    "transactionId": "AYAcUqAcAcAcAcAcASAcAcAc"
  }
}

如何确定影响我特定 url 的 Azure WAF 规则

How do determine Azure WAF rule that affect to my specific url

azure

azure-waf