WAF for Azure Application Gateway - Which ruleset is better -DRS 2.1 or OWASP 3.2

Rajiv Bansal 166 Reputation points
2024-01-23T14:51:12.5066667+00:00

I am using a WAF to secure Application Gateway. Azure portal provide option to choose either of two default rule sets:

  • Microsoft Default Rule Set 2.1
  • OWASP 3.2

Although documentation says that both rule sets are applied by default in detection mode. But the portal user interface provide option to select either of these two.

I want to know which rule set is better and more comprehensive. Is there any option to apply both rule sets together and is it advisable?

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,002 questions
Azure Web Application Firewall
0 comments
Accepted answer
  1. ChaitanyaNaykodi-MSFT 24,231 Reputation points Microsoft Employee
    2024-01-24T00:28:56.2+00:00

    @Rajiv Bansal
    Thank you for reaching out.

    I understand you wish to know which ruleset Microsoft Default Rule Set 2.1 or OWASP 3.2 is more comprehensive coverage.

    I think the Microsoft Default Rule Set 2.1 will be better option here because DRS 2.1 is baselined off the Open Web Application Security Project (OWASP) Core Rule Set (CRS) 3.3.2 and extended to include additional proprietary protections rules developed by Microsoft Threat Intelligence team. The Microsoft Threat Intel team analyzes Common Vulnerabilities and Exposures (CVEs) and further adapts the CRS ruleset to address CVEs and reduce false positives.

    This is information currently documented here

    Additional reference: https://video2.skills-academy.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules?tabs=owasp32#drs-21

    Is there any option to apply both rule sets together and is it advisable?

    Currently it is not possible to apply both the rulesets. Although you can explore the option of using Per Site/ Per URI policies supported by Application Gateway. More information can be found here.

    Although documentation says that both rule sets are applied by default in detection mode

    Meanwhile can you please share a link to the documentation where this is documented so that we can take a look and update the doc.

    Hope this helps! Please let me know if you have any additional questions. Thank you!

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest