# How to create a WAF rule set

import Tabs from '~/components/tabs/Tabs'
import Code from '~/components/Code/Code.astro'

[Web Application Firewall (WAF)](/en/documentation/products/secure/firewall/web-application-firewall/) allows you to create rule sets regarding possible [threat types](/en/documentation/products/secure/firewall/web-application-firewall/#waf-main-settings). You can set these rule sets on Rules Engine for Firewall to execute their behaviors.

This guide will create a rule set to block threats from the **SQL Injection** family to prevent attacks that attempt a `select` query, for example. After [creating an firewall](/en/documentation/products/guides/secure/firewall-configure-main-settings/) and [activating the WAF module](/en/documentation/products/guides/secure/firewall-configure-main-settings/#modules), follow the steps described next.

---

<Tabs client:visible>
    <Fragment slot="tab.console">Console</Fragment>
    <Fragment slot="tab.api">API</Fragment>

<Fragment slot="panel.console">
1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **WAF Rules**.
2. Click the **+ WAF Rule** button.
3. On the **Name** field, give your WAF rule set a unique and easy-to-remember name. In this case, `SQL Injection rule set`.
4. On the **Threat Type Configuration** section, look for the **SQL Injection** option.
5. Choose the **Sensitivity** option **High** for this threat so WAF doesn't allow requests considered as an SQL Injection threat.
6. Make sure the **Active** switch is enabled.
7. Click the **Save** button.

Repeat this process with other types of threats to which you want to create a rule set.

Now, you need to apply the rule set you've created in **Rules Engine**. To do so:

1. Still on Azion Console, go to **Firewall**.
2. Select the firewall you want to apply the new rule.
3. Select the **Rules Engine** tab.
4. Click the **+ Rule** button.
5. Give your rule a name and, optionally, a description.
6. In the **Criteria** section, select the `Request Args` variable.
7. As a comparison operator, select `matches`.
8. As an argument, add `content-type=select`.
9. In the **Behaviors** section, select **Set WAF Rule Set**.
10. As arguments:
    - On the first dropdown menu, select the rule set you want to use. In this case, `SQL Injection rule set`.
    - On the second dropdown menu, select the mode you want Firewall to operate on: **Learning** or **Blocking**. In this case, **Blocking**.
11. Click the **Save** button.
</Fragment>

<Fragment slot="panel.api">
1. Run the following `POST` request to create a rule, replacing `[TOKEN VALUE]` with your [personal token](/en/documentation/products/guides/personal-tokens/):

<Code lang="bash" code={`
curl --request POST \
  --url https://api.azion.com/v4/edge_firewall/wafs \
  --header 'Accept: application/json' \
  --header 'Authorization: Token [TOKEN]' \
  --header 'Content-Type: application/json' \
  --data '{
    "active": true,
    "name": "My WAF",
    "product_version": "1.0",
    "engine_settings": {
      "engine_version": "2021-Q3",
      "type": "score",
      "attributes": {
        "rulesets": [1],
        "thresholds": [
          { "threat": "cross_site_scripting", "sensitivity": "medium" },
          { "threat": "directory_traversal",  "sensitivity": "medium" },
          { "threat": "evading_tricks",       "sensitivity": "medium" },
          { "threat": "file_upload",          "sensitivity": "medium" },
          { "threat": "identified_attack",    "sensitivity": "medium" },
          { "threat": "remote_file_inclusion","sensitivity": "medium" },
          { "threat": "sql_injection",        "sensitivity": "medium" },
          { "threat": "unwanted_access",      "sensitivity": "medium" }
        ]
      }
    }
  }'
`} />


2. Copy the `id` value.
3. Run the following `POST` request to create a rule, replacing `[TOKEN VALUE]` with your [personal token](/en/documentation/products/guides/personal-tokens/), the `<edge_firewall_id>` variable with your [firewall id](https://api.azion.com/#090fa5b0-3d68-4521-9a90-f4d93773f6d9) value, and `<waf_rule_set_id>` with the id you copied:

<Code lang="bash" code={`
curl --request POST \
  --url https://api.azion.com/v4/edge_firewall/firewalls/<edge_firewall_id>/request_rules \
  --header 'Accept: application/json' \
  --header 'Authorization: Token [TOKEN]' \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "SQL Injection rule",
    "active": true,
    "criteria": [
      [
        {
          "conditional": "if",
          "variable": "\${request_args}",
          "operator": "matches",
          "argument": "content-type=select"
        }
      ]
    ],
    "behaviors": [
      {
        "type": "set_waf",
        "attributes": {
          "waf_id": <waf_rule_set_id>
        }
      }
    ]
  }'
`} />


| Key | Description |
| --- | --- |
| `name` | Name of the rule |
| `behaviors` | Array that stores objects defining behaviors |
| `criteria` | Array that stores objects defining criteria |

See the [Azion API documentation](https://www.azion.com/en/documentation/products/overview-azion-api/) to find out more about criteria and behavior objects.

Wait a few minutes for the changes to propagate.

:::tip
Check the [Azion API documentation](https://api.azion.com/) to know more about all features available via API.
:::
</Fragment>

</Tabs>

---