[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eGoogle Cloud Armor offers preconfigured WAF rules derived from OWASP CRS 3.0 and 3.3.2, allowing the evaluation of numerous distinct traffic signatures using named rules rather than manual definition.\u003c/p\u003e\n"],["\u003cp\u003eThese preconfigured WAF rules can be tuned to adjust their sensitivity levels, ranging from 1 to 4, where lower sensitivity indicates higher confidence and less false positives, while higher sensitivity increases security but with a higher risk of false positives.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Cloud Armor rules cover a range of attack types such as SQL injection, cross-site scripting, local and remote file inclusion, remote code execution, method enforcement, scanner detection, protocol attacks, PHP injection, session fixation, Java and NodeJS attacks.\u003c/p\u003e\n"],["\u003cp\u003eThe service offers \u003ccode\u003ecve-canary\u003c/code\u003e rules to specifically detect vulnerabilities like Log4j RCE (\u003ccode\u003eCVE-2021-44228\u003c/code\u003e and \u003ccode\u003eCVE-2021-45046\u003c/code\u003e) and \u003ccode\u003e942550-sqli\u003c/code\u003e to detect JSON-formatted content SQLi vulnerabilities.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Cloud Armor preconfigured WAF rules have some limitations such as only processing \u003ccode\u003ePOST\u003c/code\u003e request types and only inspecting the first 8KB of \u003ccode\u003ePOST\u003c/code\u003e body content.\u003c/p\u003e\n"]]],[],null,["# Cloud Armor preconfigured WAF rules overview\n\nGoogle Cloud Armor preconfigured WAF rules are complex web application firewall (WAF)\nrules with dozens of *signatures* that are compiled from open source industry\nstandards. Each signature corresponds to an attack detection\nrule in the ruleset. Google offers these rules as is. The rules let\nCloud Armor evaluate dozens of distinct traffic signatures by\nreferring to conveniently named rules rather than requiring you to define\neach signature manually.\n\nGoogle Cloud Armor preconfigured WAF rules can be tuned to best suit your needs. For more\ninformation about how to tune the rules, see\n[Tune Google Cloud Armor preconfigured WAF rules](/armor/docs/rule-tuning).\n\nThe following table contains a comprehensive list of preconfigured WAF rules\nthat are available for use in a Cloud Armor security policy. The\nrule sources are OWASP Core Rule Set (CRS)\n[3.3.2](https://github.com/coreruleset/coreruleset/releases/tag/v3.3.2).\nWe recommend that you use version 3.3 for increased sensitivity and for an\nincreased breadth of protected attack types. Support for CRS 3.0 is ongoing. \n\n### CRS 3.3\n\n### CRS 3.0\n\nIn addition, the following `cve-canary` rules are available to all\nCloud Armor customers to help detect and optionally block the\nfollowing vulnerabilities:\n\n- `CVE-2021-44228` and `CVE-2021-45046` Log4j RCE vulnerabilities\n- `942550-sqli` JSON-formatted content vulnerability\n\nPreconfigured OWASP rules\n-------------------------\n\nEach preconfigured WAF rule has a sensitivity level that corresponds to a\nOWASP CRS\n[paranoia level](https://coreruleset.org/faq/#paranoialevel).\nA lower sensitivity level indicates a higher confidence signature, which is less\nlikely to generate a false positive. A higher sensitivity level increases\nsecurity, but also increases the risk of generating a false positive.\n\n### SQL injection (SQLi)\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of each supported signature in the SQLi preconfigured WAF rule. \n\n### CRS 3.3\n\n### CRS 3.0\n\nYou can configure a rule at a particular sensitivity level by using\n`evaluatePreconfiguredWaf()` with a preset sensitivity parameter. By\ndefault, without configuring rule set sensitivity, Cloud Armor\nevaluates all signatures. \n\n### CRS 3.3\n\n### CRS 3.0\n\n### Cross-site scripting (XSS)\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of each supported signature in the XSS preconfigured WAF rule. \n\n### CRS 3.3\n\n### CRS 3.0\n\nYou can configure a rule at a particular sensitivity level by\nusing `evaluatePreconfiguredWaf()` with a preset sensitivity parameter. By\ndefault, without configuring rule set sensitivity, Cloud Armor\nevaluates all signatures. \n\n### CRS 3.3\n\n### CRS 3.0\n\n### Local file inclusion (LFI)\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of each supported signature in the LFI preconfigured WAF rule. \n\n### CRS 3.3\n\n### CRS 3.0\n\nYou can configure a rule at a particular sensitivity level by\nusing `evaluatePreconfiguredWaf()` with a preset sensitivity parameter. All\nsignatures for LFI are at sensitivity level 1. The following configuration\nworks for all sensitivity levels: \n\n### CRS 3.3\n\n### CRS 3.0\n\n### Remote code execution (RCE)\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of each supported signature in the RCE preconfigured WAF rule. \n\n### CRS 3.3\n\n### CRS 3.0\n\nYou can configure a rule at a particular sensitivity level by\nusing `evaluatePreconfiguredWaf()` with a preset sensitivity parameter. All\nsignatures for RCE are at sensitivity level 1. The following configuration works\nfor all sensitivity levels: \n\n### CRS 3.3\n\n### CRS 3.0\n\n### Remote file inclusion (RFI)\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of each supported signature in the RFI preconfigured WAF rule. \n\n### CRS 3.3\n\n### CRS 3.0\n\nYou can configure a rule at a particular sensitivity level by\nusing `evaluatePreconfiguredWaf()` with a preset sensitivity parameter. By\ndefault, without configuring rule set sensitivity, Cloud Armor\nevaluates all signatures. \n\n### CRS 3.3\n\n### CRS 3.0\n\n### Method enforcement\n\n| **Note:** CRS 3.3 allows only the `GET`, `HEAD`, `POST`, and `OPTIONS` HTTP methods.\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of each supported signature in the method enforcement preconfigured\nrule. \n\n### CRS 3.3\n\n### CRS 3.0\n\nYou can configure a rule at a particular sensitivity level by\nusing `evaluatePreconfiguredWaf()` with a preset sensitivity parameter. By\ndefault, without configuring rule set sensitivity, Cloud Armor\nevaluates all signatures. \n\n### CRS 3.3\n\n### CRS 3.0\n\n### Scanner detection\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of each supported signature in the scanner detection preconfigured\nrule. \n\n### CRS 3.3\n\n### CRS 3.0\n\nYou can configure a rule at a particular sensitivity level by\nusing `evaluatePreconfiguredWaf()` with a preset sensitivity parameter. By\ndefault, without configuring rule set sensitivity, Cloud Armor\nevaluates all signatures. \n\n### CRS 3.3\n\n### CRS 3.0\n\n### Protocol attack\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of each supported signature in the protocol attack preconfigured\nrule. \n\n### CRS 3.3\n\n### CRS 3.0\n\nYou can configure a rule at a particular sensitivity level by\nusing `evaluatePreconfiguredWaf()` with a preset sensitivity parameter. By\ndefault, without configuring rule set sensitivity, Cloud Armor\nevaluates all signatures. \n\n### CRS 3.3\n\n### CRS 3.0\n\n### PHP\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of each supported signature in the PHP preconfigured WAF rule. \n\n### CRS 3.3\n\n### CRS 3.0\n\nYou can configure a rule at a particular sensitivity level by\nusing `evaluatePreconfiguredWaf()` with a preset sensitivity parameter. By\ndefault, without configuring rule set sensitivity, Cloud Armor\nevaluates all signatures. \n\n### CRS 3.3\n\n### CRS 3.0\n\n### Session fixation\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of each supported signature in the session fixation preconfigured\nrule. \n\n### CRS 3.3\n\n### CRS 3.0\n\nYou can configure a rule at a particular sensitivity level by\nusing `evaluatePreconfiguredWaf()` with a preset sensitivity parameter. All\nsignatures for session fixation are at sensitivity level 1. The following\nconfiguration works for all sensitivity levels: \n\n### CRS 3.3\n\n### CRS 3.0\n\n### Java attack\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of each supported signature in the Java attack preconfigured\nrule. \n\n### CRS 3.3\n\n### CRS 3.0\n\nYou can configure a rule at a particular sensitivity level by\nusing `evaluatePreconfiguredWaf()` with a preset sensitivity parameter. By\ndefault, without configuring rule set sensitivity, Cloud Armor\nevaluates all signatures.\n\n### NodeJS attack\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of each supported signature in the NodeJS attack preconfigured\nrule.\n\nThe following preconfigured WAF rule signatures are only included in CRS\n3.3. \n\n### CRS 3.3\n\n### CRS 3.0\n\nYou can configure a rule at a particular sensitivity level by\nusing `evaluatePreconfiguredWaf()` with a preset sensitivity parameter. All\nsignatures for NodeJS attack are at sensitivity level 1. The following\nconfiguration works for other sensitivity levels:\n\n### CVEs and other vulnerabilities\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of each supported signature in the CVE Log4j RCE vulnerability\npreconfigured rule.\n\nYou can configure a rule at a particular sensitivity level by\nusing `evaluatePreconfiguredWaf()` with a preset sensitivity parameter. By\ndefault, without configuring rule set sensitivity, Cloud Armor\nevaluates all signatures.\n\n### JSON-formatted content SQLi vulnerability\n\nThe following table provides the signature ID, sensitivity level, and\ndescription of the supported signature\n[`942550-sqli`](https://github.com/coreruleset/coreruleset/pull/3055),\nwhich covers the vulnerability in which malicious attackers can\nbypass WAF by appending JSON syntax to SQL injection payloads.\n\nUse the following expression to deploy the signature:\n\n\u003cbr /\u003e\n\n```\n evaluatePreconfiguredWaf('json-sqli-canary', {'sensitivity':0, 'opt_in_rule_ids': ['owasp-crs-id942550-sqli']})\n \n```\n\n\u003cbr /\u003e\n\nWe recommend that you also enable `sqli-v33-stable` at sensitivity level 2 to\nfully address JSON-based SQL injection bypasses.\n\nLimitations\n-----------\n\nCloud Armor preconfigured WAF rules have the following limitations:\n\n- WAF rule changes typically take several minutes to propagate.\n- Among the HTTP request types with a request body, Cloud Armor processes only `POST` requests. Cloud Armor evaluates preconfigured rules against the first 8 KB of `POST` body content. For more information, see [`POST` body inspection limitation](/armor/docs/security-policy-overview#post-body).\n- Cloud Armor can parse and apply preconfigured WAF rules to JSON-formatted content (including properly formatted [GraphQL over HTTP](https://graphql.org/learn/serving-over-http/#headers) requests) when JSON parsing is enabled with a matching `Content-Type` header value. For more information, see [JSON parsing](/armor/docs/security-policy-overview#json-parsing).\n- When you have a request field exclusion attached to a preconfigured WAF rule, you can't use the `allow` action. Requests matching the exception are automatically allowed.\n\nWhat's next\n-----------\n\n- [Tune preconfigured WAF rules](/armor/docs/rule-tuning)\n- [Configure custom rules language attributes](/armor/docs/rules-language-reference)"]]
