Generate WAF Rules for Multiple Platforms

This skill generates Web Application Firewall rules across AWS WAF, ModSecurity, Cloudflare WAF, F5 ASM, and Azure WAF. It applies rule design principles - layered defense-in-depth, performance-first rule ordering (fast byte-matching before expensive regex), precision targeting to reduce false positives, and a BLOCK/ALLOW/COUNT/LOG action hierarchy - covering attack vectors including SQLi, XSS, RFI/LFI, command injection/RCE, XXE, SSRF, directory traversal, and HTTP protocol violations. It implements AWS WAF v2 JSON rules combining byte-match and regex statements with text transformations (URL decode, lowercase, HTML entity decode), ModSecurity OWASP-CRS-style rules for XSS detection via libinjection and IP-based rate limiting with setvar/expirevar, Cloudflare WAF custom rule expressions for SQLi detection and login-endpoint rate limiting with IP allowlisting, false-positive mitigation via path-based rule exclusions and user-agent whitelisting, multi-vector AND-combined detection (geo plus rate plus path matching), dynamic IP reputation scoring rules, and rule maintenance practices (version control, staged deployment, rollback procedures, monitoring dashboards).

Use this skill when writing or tuning WAF rules for a web application - writing an AWS WAF v2 rule combining byte-match and regex detection for SQLi, writing a ModSecurity XSS or rate-limiting rule in OWASP CRS style, writing a Cloudflare custom rule expression for SQLi or endpoint rate limiting, mitigating a false positive with a path or user-agent whitelist, combining multiple conditions into a multi-vector detection rule, or setting up staged deployment and monitoring for rule changes.

It does not cover network-layer firewalls or IDS/IPS signature writing - it is focused specifically on application-layer WAF rules across major platforms.

Inputs are typically the application's attack surface and the target WAF platform. Outputs include platform-specific rules, for example an AWS WAF v2 SQL injection rule:

{
  "Name": "SQLInjectionProtection",
  "Statement": {
    "OrStatement": {
      "Statements": [
        {"ByteMatchStatement": {"SearchString": "union select", "FieldToMatch": {"AllQueryArguments": {}}, "PositionalConstraint": "CONTAINS"}},
        {"RegexMatchStatement": {"RegexString": "(?i)(union|select|insert|delete).*?(from|into|table)", "FieldToMatch": {"Body": {"OversizeHandling": "CONTINUE"}}}}
      ]
    }
  },
  "Action": {"Block": {}}
}

Other outputs include a ModSecurity XSS detection rule with OWASP CRS tags and anomaly scoring, an IP-based rate-limiting ModSecurity rule pair, Cloudflare custom rule expressions for SQLi and login rate limiting, false-positive whitelist rules for admin paths and known-good user agents, a multi-vector AND-combined detection rule, and an IP-reputation scoring rule pair.

Security and platform engineers writing or tuning WAF rules for web applications who need platform-specific syntax and false-positive mitigation rather than relying only on default managed rule sets.