Generate WAF Rules for Enhanced Security

This skill generates Web Application Firewall rules across AWS WAF, Cloudflare WAF, ModSecurity, and F5 BIG-IP ASM with an emphasis on layered, performance-optimized protection. It applies condition-based filtering, intelligent rate limiting, geolocation filtering, protocol validation, and content inspection, with rules ordered by frequency and computational complexity. It implements AWS WAF's built-in SqliMatchStatement combined across body and URI fields with text transformations, a rate-based statement scoped down to exclude a trusted IP set, ModSecurity XSS detection tagged to OWASP CRS with anomaly scoring, file upload restriction rules (Lua-based file inspection plus extension blocklisting for dangerous file types), Cloudflare custom rule expressions blocking known scanner user agents (sqlmap, nikto, nessus) and spoofable headers (x-originating-ip, x-forwarded-host), a three-layer protection strategy (protocol/infrastructure, application-specific, behavioral analysis), a threat-intelligence feed integration config (malicious IPs, Tor exit nodes, known-bad domains with hourly updates), and rule management practices (version control, staged log-only rollout before blocking, WAF bypass testing, compliance alignment with PCI DSS/GDPR).

Use this skill when designing a layered WAF rule set - using AWS WAF's native SQLi match statement across multiple fields, scoping a rate-based rule to exclude trusted IPs, writing ModSecurity file-upload restriction rules, blocking known scanning tools and spoofable headers in Cloudflare, structuring rules into protocol/application/behavioral layers, integrating external threat-intelligence feeds, or rolling out new rules in log-only mode before enforcing blocks.

It does not cover host-based intrusion detection or endpoint security - it is focused specifically on web application firewall rule design and staged rollout across major platforms.

Inputs are typically the application's attack surface and available threat-intelligence sources. Outputs include platform rules, for example an AWS WAF SQLi rule using the native match statement:

{
  "Name": "SQLInjectionRule",
  "Statement": {
    "OrStatement": {
      "Statements": [
        {"SqliMatchStatement": {"FieldToMatch": {"Body": {"OversizeHandling": "CONTINUE"}}, "TextTransformations": [{"Priority": 1, "Type": "URL_DECODE"}]}},
        {"SqliMatchStatement": {"FieldToMatch": {"UriPath": {}}, "TextTransformations": [{"Priority": 1, "Type": "URL_DECODE"}]}}
      ]
    }
  },
  "Action": {"Block": {}}
}

Other outputs include a rate-based rule scoped down to exclude a trusted IP set, ModSecurity file-upload restriction rules (Lua scanner plus dangerous extension blocklist), Cloudflare expressions blocking scanner user agents and spoofable headers, a three-layer protection strategy YAML, a threat-intelligence feed integration config, and staged log-only-to-blocking rollout guidance.

Security engineers designing a layered, staged WAF rollout who need native platform match statements, file-upload protection, and threat-feed integration rather than a single flat rule set deployed straight to blocking.