Google Cloud Armor preconfigured WAF rules overview

Google Cloud Armor preconfigured WAF rules are complex web application firewall (WAF) rules with dozens of signatures that are compiled from open source industry standards. Each signature corresponds to an attack detection rule in the ruleset. Google offers these rules as-is. The rules allow Google Cloud Armor to evaluate dozens of distinct traffic signatures by referring to conveniently named rules rather than requiring you to define each signature manually.

Google Cloud Armor preconfigured WAF rules can be tuned to best suit your needs. For more information about how to tune the rules, see Tune Google Cloud Armor preconfigured WAF rules.

The following table contains a comprehensive list of preconfigured WAF rules that are available for use in a Google Cloud Armor security policy. The rule sources are ModSecurity Core Rule Set (CRS) 3.0 and CRS 3.3.2. We recommend that you use version 3.3 for increased sensitivity and for an increased breadth of protected attack types. Support for CRS 3.0 is ongoing.

In addition, the following cve-canary rules are available to all Google Cloud Armor customers to help detect and optionally block the following vulnerabilities:

• CVE-2021-44228 and CVE-2021-45046 Log4j RCE vulnerabilities
• 942550-sqli JSON-formatted content vulnerability

Preconfigured ModSecurity rules

Each preconfigured WAF rule has a sensitivity level that corresponds to a ModSecurity paranoia level. A lower sensitivity level indicates a higher confidence signature, which is less likely to generate a false positive. A higher sensitivity level increases security, but also increases the risk of generating a false positive.

SQL injection (SQLi)

The following table provides the signature ID, sensitivity level, and description of each supported signature in the SQLi preconfigured WAF rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredExpr() to disable signatures at greater sensitivity levels.

evaluatePreconfiguredExpr('sqli-v33-stable',
['owasp-crs-v030301-id942110-sqli',
  'owasp-crs-v030301-id942120-sqli',
  'owasp-crs-v030301-id942130-sqli',
  'owasp-crs-v030301-id942150-sqli',
  'owasp-crs-v030301-id942180-sqli',
  'owasp-crs-v030301-id942200-sqli',
  'owasp-crs-v030301-id942210-sqli',
  'owasp-crs-v030301-id942260-sqli',
  'owasp-crs-v030301-id942300-sqli',
  'owasp-crs-v030301-id942310-sqli',
  'owasp-crs-v030301-id942330-sqli',
  'owasp-crs-v030301-id942340-sqli',
  'owasp-crs-v030301-id942361-sqli',
  'owasp-crs-v030301-id942370-sqli',
  'owasp-crs-v030301-id942380-sqli',
  'owasp-crs-v030301-id942390-sqli',
  'owasp-crs-v030301-id942400-sqli',
  'owasp-crs-v030301-id942410-sqli',
  'owasp-crs-v030301-id942470-sqli',
  'owasp-crs-v030301-id942480-sqli',
  'owasp-crs-v030301-id942430-sqli',
  'owasp-crs-v030301-id942440-sqli',
  'owasp-crs-v030301-id942450-sqli',
  'owasp-crs-v030301-id942510-sqli',
  'owasp-crs-v030301-id942251-sqli',
  'owasp-crs-v030301-id942490-sqli',
  'owasp-crs-v030301-id942420-sqli',
  'owasp-crs-v030301-id942431-sqli',
  'owasp-crs-v030301-id942460-sqli',
  'owasp-crs-v030301-id942101-sqli',
  'owasp-crs-v030301-id942511-sqli',
  'owasp-crs-v030301-id942421-sqli',
  'owasp-crs-v030301-id942432-sqli']
)
          

evaluatePreconfiguredExpr('sqli-v33-stable',
 ['owasp-crs-v030301-id942251-sqli',
  'owasp-crs-v030301-id942490-sqli',
  'owasp-crs-v030301-id942420-sqli',
  'owasp-crs-v030301-id942431-sqli',
  'owasp-crs-v030301-id942460-sqli',
  'owasp-crs-v030301-id942101-sqli',
  'owasp-crs-v030301-id942511-sqli',
  'owasp-crs-v030301-id942421-sqli',
  'owasp-crs-v030301-id942432-sqli']
)

evaluatePreconfiguredExpr('sqli-v33-stable',
        ['owasp-crs-v030301-id942421-sqli',
         'owasp-crs-v030301-id942432-sqli']
         )

evaluatePreconfiguredExpr('sqli-v33-stable')

Alternatively, you can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf() with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Google Cloud Armor evaluates all signatures.

Cross-site scripting (XSS)

The following table provides the signature ID, sensitivity level, and description of each supported signature in the XSS preconfigured WAF rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredExpr() to disable signatures at greater sensitivity levels.

evaluatePreconfiguredExpr('xss-v33-stable',
['owasp-crs-v030301-id941101-xss',
  'owasp-crs-v030301-id941150-xss',
  'owasp-crs-v030301-id941320-xss',
  'owasp-crs-v030301-id941330-xss',
  'owasp-crs-v030301-id941340-xss',
  'owasp-crs-v030301-id941380-xss'
])
          

All signatures for XSS are below sensitivity level 2. The following configuration works for other sensitivity levels:

evaluatePreconfiguredExpr('xss-v33-stable')

Alternatively, you can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf() with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Google Cloud Armor evaluates all signatures.

Local file inclusion (LFI)

The following table provides the signature ID, sensitivity level, and description of each supported signature in the LFI preconfigured WAF rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredExpr() to disable signatures at greater sensitivity levels. All signatures for LFI are at sensitivity level 1. The following configuration works for all sensitivity levels:

evaluatePreconfiguredExpr('lfi-v33-stable')

Alternatively, you can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf() with a preset sensitivity parameter. All signatures for LFI are at sensitivity level 1. The following configuration works for all sensitivity levels:

Remote code execution (RCE)

The following table provides the signature ID, sensitivity level, and description of each supported signature in the RCE preconfigured WAF rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredExpr() to disable signatures at greater sensitivity levels. The following configuration works for all sensitivity levels:

evaluatePreconfiguredExpr('rce-v33-stable',
          ['owasp-crs-v030301-id932200-rce',
           'owasp-crs-v030301-id932106-rce',
           'owasp-crs-v030301-id932190-rce'])
          

evaluatePreconfiguredExpr('rce-v33-stable',
           [ 'owasp-crs-v030301-id932106-rce',
           'owasp-crs-v030301-id932190-rce'])
          

evaluatePreconfiguredExpr('rce-v33-stable')

Alternatively, you can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf() with a preset sensitivity parameter. All signatures for RCE are at sensitivity level 1. The following configuration works for all sensitivity levels:

Remote file inclusion (RFI)

The following table provides the signature ID, sensitivity level, and description of each supported signature in the RFI preconfigured WAF rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredExpr() to disable signatures at greater sensitivity levels.

evaluatePreconfiguredExpr('rfi-v33-stable', ['owasp-crs-v030301-id931130-rfi'])

All signatures for RFI are below sensitivity level 2. The following configuration works for other sensitivity levels:

evaluatePreconfiguredExpr('rfi-v33-stable')

Alternatively, you can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf() with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Google Cloud Armor evaluates all signatures.

Method enforcement

The following table provides the signature ID, sensitivity level, and description of each supported signature in the method enforcement preconfigured rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredExpr() to disable signatures at greater sensitivity levels. All signatures for Method Enforcement are at sensitivity level 1. The following configuration works for other sensitivity levels:

evaluatePreconfiguredExpr('methodenforcement-v33-stable')

Alternatively, you can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf() with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Google Cloud Armor evaluates all signatures.

Scanner detection

The following table provides the signature ID, sensitivity level, and description of each supported signature in the scanner detection preconfigured rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredExpr() to disable signatures at greater sensitivity levels.

evaluatePreconfiguredExpr('scannerdetection-v33-stable',
  ['owasp-crs-v030301-id913101-scannerdetection',
  'owasp-crs-v030301-id913102-scannerdetection']
)
          

evaluatePreconfiguredExpr('scannerdetection-v33-stable')
          

Alternatively, you can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf() with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Google Cloud Armor evaluates all signatures.

Protocol attack

The following table provides the signature ID, sensitivity level, and description of each supported signature in the protocol attack preconfigured rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredExpr() to disable signatures at greater sensitivity levels.

evaluatePreconfiguredExpr('protocolattack-v33-stable',
  ['owasp-crs-v030301-id921151-protocolattack',
  'owasp-crs-v030301-id921170-protocolattack']
)
          

evaluatePreconfiguredExpr('protocolattack-v33-stable',
  ['owasp-crs-v030301-id921170-protocolattack']
)
          

evaluatePreconfiguredExpr('protocolattack-v33-stable')
          

Alternatively, you can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf() with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Google Cloud Armor evaluates all signatures.

PHP

The following table provides the signature ID, sensitivity level, and description of each supported signature in the PHP preconfigured WAF rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredExpr() to disable signatures at greater sensitivity levels.

evaluatePreconfiguredExpr('php-v33-stable',
['owasp-crs-v030301-id933151-php',
  'owasp-crs-v030301-id933131-php',
  'owasp-crs-v030301-id933161-php',
  'owasp-crs-v030301-id933111-php',
  'owasp-crs-v030301-id933190-php']
)
          

evaluatePreconfiguredExpr('php-v33-stable',
  ['owasp-crs-v0303001-id933131-php',
  'owasp-crs-v0303001-id933161-php',
  'owasp-crs-v0303001-id933111-php',
  'owasp-crs-v030301-id933190-php'])
          

evaluatePreconfiguredExpr('php-v33-stable')
          

Alternatively, you can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf() with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Google Cloud Armor evaluates all signatures.

Session fixation

The following table provides the signature ID, sensitivity level, and description of each supported signature in the session fixation preconfigured rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredExpr() to disable signatures at greater sensitivity levels. All signatures for session fixation are at sensitivity level 1. The following configuration works for all sensitivity levels:

evaluatePreconfiguredExpr('sessionfixation-v33-stable')

Alternatively, you can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf() with a preset sensitivity parameter. All signatures for session fixation are at sensitivity level 1. The following configuration works for all sensitivity levels:

Java attack

The following table provides the signature ID, sensitivity level, and description of each supported signature in the Java attack preconfigured rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredExpr() to disable signatures at greater sensitivity levels.

evaluatePreconfiguredExpr('java-v33-stable',
['owasp-crs-v030301-id944200-java',
 'owasp-crs-v030301-id944210-java',
 'owasp-crs-v030301-id944240-java',
 'owasp-crs-v030301-id944250-java',
 'owasp-crs-v030301-id944300-java'])
          

evaluatePreconfiguredExpr('java-v33-stable',
['owasp-crs-v030301-id944300-java'])
          

evaluatePreconfiguredExpr('java-v33-stable')
          

Alternatively, you can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf() with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Google Cloud Armor evaluates all signatures.

NodeJS attack

The following table provides the signature ID, sensitivity level, and description of each supported signature in the NodeJS attack preconfigured rule.

The following preconfigured WAF rule signatures are only included in CRS 3.3.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredExpr() to disable signatures at greater sensitivity levels. All signatures for NodeJS attack are at sensitivity level 1. The following configuration works for other sensitivity levels:

evaluatePreconfiguredExpr('nodejs-v33-stable')

Alternatively, you can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf() with a preset sensitivity parameter. All signatures for NodeJS attack are at sensitivity level 1. The following configuration works for other sensitivity levels:

CVEs and other vulnerabilities

The following table provides the signature ID, sensitivity level, and description of each supported signature in the CVE Log4j RCE vulnerability preconfigured rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredExpr() to disable signatures at greater sensitivity levels.

evaluatePreconfiguredExpr('cve-canary', ['owasp-crs-v030001-id244228-cve',
  'owasp-crs-v030001-id344228-cve'])
          

evaluatePreconfiguredExpr('cve-canary')

Alternatively, you can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf() with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Google Cloud Armor evaluates all signatures.

JSON-formatted content SQLi vulnerability

The following table provides the signature ID, sensitivity level, and description of the supported signature 942550-sqli, which covers the vulnerability in which malicious attackers can bypass WAF by appending JSON syntax to SQL injection payloads.

Use the following expression to deploy the signature:

  evaluatePreconfiguredWaf('json-sqli-canary', {'sensitivity':0, 'opt_in_rule_ids': ['owasp-crs-id942550-sqli']})
  

We recommend that you also enable sqli-v33-stable at sensitivity level 2 to fully address JSON-based SQL injection bypasses.

Limitations

Google Cloud Armor preconfigured WAF rules have the following limitations:

• WAF rule changes typically take several minutes to propagate.
• Among the HTTP request types with a request body, Google Cloud Armor processes only POST requests. Google Cloud Armor evaluates preconfigured rules against the first 8 KB of POST body content. For more information, see POST body inspection limitation.
• Google Cloud Armor can parse and apply preconfigured WAF rules when JSON parsing is enabled with a matching Content-Type header value. For more information, see JSON parsing.
• When you have a request field exclusion attached to a preconfigured WAF rule, you can't use the allow action. Requests matching the exception are automatically allowed.

What's next

• Tune WAF rules
• Use the custom rules language reference