Hi Team, We are using Azure Front Door. And using by default WAF rules. But WAF is blocking some requests, in diagnostic logs we found rule_name Microsoft_DefaultRuleSet-2.0-BLOCKING-EVALUATION-949110 Please let us know is there any way to unblock/bypass/exception for this, as it is not from the list of managed rules.

Hi @Deshmukh, Vijit , Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I understand that you are hitting the WAF rule 949110 with your AFD. Please note that Rule 949110 cannot be disabled . This rule means Inbound Anomaly Score Exceeded. This is triggered when the anomaly threshold exceeds. This is in-turn caused by other rules that are hit which increase the anomaly score. You have to check the diagnostic logs and find the exact rules that are increasing the anomaly score. You should create the custom rules or exceptions to bypass the rules which increase the anomaly score. Refer : Web Application Firewall DRS rule groups and rules The following docs may come in handy Tuning Web Application Firewall (WAF) Anomaly scoring Cheers, Kapil ---------------------------------------------------------------------------------------------------------------- Please don’t forget to close the thread by clicking " Accept the answer " wherever the information provided helps you, as this can be beneficial to other community members.

How to disable Microsoft_DefaultRuleSet-2.0-BLOCKING-EVALUATION-949110?

Accepted answer

KapilAnanth-MSFT 48,741 Reputation points Microsoft Employee

2022-11-09T07:12:24.183+00:00
Hi @Deshmukh, Vijit ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are hitting the WAF rule 949110 with your AFD.

Please note that Rule 949110 cannot be disabled.

This rule means Inbound Anomaly Score Exceeded.

This is triggered when the anomaly threshold exceeds. This is in-turn caused by other rules that are hit which increase the anomaly score.

You have to check the diagnostic logs and find the exact rules that are increasing the anomaly score.

You should create the custom rules or exceptions to bypass the rules which increase the anomaly score.

Refer: Web Application Firewall DRS rule groups and rules

The following docs may come in handy
Tuning Web Application Firewall (WAF)
Anomaly scoring

Cheers,
Kapil

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.

1 person found this answer helpful.
Deshmukh, Vijit 516 Reputation points

2022-11-09T11:26:16.447+00:00

Hi @KapilAnanth-MSFT

From the logs: ruleName_s : Microsoft_DefaultRuleSet-2.0-BLOCKING-EVALUATION-949110
Please help us to understand how it can be excepted.

KapilAnanth-MSFT 48,741 Reputation points Microsoft Employee

2022-11-09T12:00:28.597+00:00

Hi @Deshmukh, Vijit ,

As stated in my previous answer, the Rule 949110 cannot be bypassed or excluded

This rule gets triggered when there is an anomaly increase caused by other rules.
You have to understand what are the rules that increase the anomaly and exclude/bypass them, not this rule.

Now, wrt other rules,

They are dependent on the request you are sending and also on your application

Once you figure out which rule(s) increased the anomaly, refer to this: DRS 2.0

Based on the description in the docs, you will understand why this rule(s) are getting triggered and that should help you to come up with a custom rule to bypass this.

Or create an exclusion in the WAF policy

Or simply disable the rule

Again, Custom rules/Exclusions cannot be created to bypass 949110

Create Custom Rules : https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-custom-rules
Create Exclusion : https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-exclusion
Disabling the Rule : https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-tuning?pivots=front-door-standard-premium#disabling-rules

Cheers,
Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to disable Microsoft_DefaultRuleSet-2.0-BLOCKING-EVALUATION-949110?

0 additional answers

Your answer