Observation, parsing and tuning evidence | WAF: application protection and operations

A match may not interrupt

The same rule 1001 runs with the engine On and DetectionOnly. In the first case it requests interruption; in the second it still appears in matches without a disruptive action. This helps observe a policy before enforcing it but does not prove content is safe or authorized. Off is different because it does not process rules. In a change meeting, state the mode explicitly and separate matches, requested interruptions and decisions enforced by the connector. Without this separation, two teams can describe different results using the same word “blocked”.

Investigate where a score came from

The teaching rules add three points when alpha matches and two when beta matches. Final rule 2003 compares the sum with five. Alpha alone does not interrupt; alpha and beta together interrupt. Raising the threshold to six retains both recorded contributions but removes interruption. The exercise uses its own score without reproducing full CRS configuration. For a false positive, investigate contributions and involved fields before globally changing the threshold. The last rule explains the decision but does not itself identify the source of misclassification.

Measure what is restored and what is lost

In an analysis exercise, the set contains two hundred legitimate requests and twenty controls expected to be blocked. The change reduces false blocks from eight to two, moving from four to one percent in that legitimate set. However, only fourteen of the twenty controls remain detected. Improved availability coexisted with six detection losses. These numbers are teaching inputs, not a measurement of the Coraza lab’s efficacy. Identify lost cases, assess change scope and avoid promoting a policy from a single aggregate percentage.

Confirm the representation available to rules

The JSON test sends the same marker found in form data. Without explicitly selecting the JSON processor, the ARGS rule does not match in this fixture. With selection in phase 1, the field becomes available and the rule interrupts. A truncated body triggers an original error rule configured to request 422. That code is an exercise choice. The earlier absence of matching was not a security improvement: the expected representation was missing. Parsing also does not replace schema, authorization and invariants that remain part of the application contract.

Compare the transformation sequence

Synthetic header LAB%4DARKER goes through urlDecode then lowercase, producing a match with labmarker. In reverse order the comparison stops matching: decoding introduces an uppercase letter after lowercasing. The runner retains the original input and executes no backend. The observation therefore demonstrates the inspection decision without proving rewriting of a delivered request. When changing transformations, use known inputs, record the exact sequence and check connector and application behavior before generalizing to a real service.

Deliver versioned evidence with limits

The lab retains main.go, go.mod, go.sum and hashes of all three, with Coraza 3.8.0 and Go 1.27.1 versions. The Go archive was compared with the checksum published at the official address; this is not a claim of PGP verification. CRS was not loaded and AWS WAF was not executed. To accept an integrated policy, add browser, API and batch checks, interruption handling and recovery. The summary is that fewer blocks constitute improvement only when representation, decision and retained coverage have been checked within the relevant scope.

# From content/labs/waf-tuning; requires Go and the pinned modules
go run. /tmp/waf-evidence.json
# Eight offline observation groups; no listener or HTTP requests
# engineMode, runtimeExclusion, staticExclusion, lateExclusion
# phaseOrder, scoring, transformationOrder, bodyProcessor

IN PRACTICE

Fictional case: the batch moves to JSON and markers stop matching. The team confirms the processor before interpreting fewer blocks as improvement.

Common pitfalls

Confusing DetectionOnly with Off, missing parsing with safe traffic, score with paranoia level, or transformed inspection with backend rewriting.

Related topics: Order, actions, and overrides · Parsing and inspection limits · Tuning and false positives

Take this idea with you

Interpret results through mode, representation, rules and connector. Reassess policy with legitimate cases and coverage that must remain.

Create account

Reference: Coraza body processing · BigSavant WAF 2026-09; selected AWS WAF and OWASP CRS operational concepts