# How to tune WAF

import Tag from '~/components/webkit/Tag.vue'
import DocButton from '~/components/webkit/DocButton.vue';
import Tabs from '~/components/tabs/Tabs'
import Apiv4Rollout from '~/includes/snippets/apiv4Rollout/en/snippet.mdx'

<Apiv4Rollout />


You can use the [WAF Tuning](/en/documentation/products/secure/firewall/web-application-firewall/#waf-tuning) feature to analyze network lists, IPs, and countries that have matched configured WAF rule sets.

In this guide, you'll filter possible attacks in your WAF and create an allowed rule from the results you receive.

There are separate instructions for API v3 using [legacy Domains](/en/documentation/products/build/applications/domains/) settings and API v4 using the new [Workloads](/en/documentation/products/secure/workloads) product.

:::tip
If you're not sure which steps apply to your account, see [the Verify Your Account Migration guide](/en/documentation/products/guides/verify-account-migration/) to determine if your account has already been migrated.
:::

---

## Tuning WAF

Requires:

- <Tag severity="info">[Configured firewall](/en/documentation/products/guides/secure/firewall-configure-main-settings/)</Tag><br></br>

- <Tag severity="info">[Activated WAF in the firewall](/en/documentation/products/guides/secure/firewall-configure-main-settings/#modules)</Tag>

<Tabs client:visible>
    <Fragment slot="tab.consoleworkloads">Console - Workloads</Fragment>
    <Fragment slot="tab.consoledomains">Console - Domains</Fragment>


<Fragment slot="panel.consoleworkloads">

After setting up the initial configurations, proceed as follows:

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **WAF Rules**.
2. Select the WAF Rule Set you want to tune or [create a new one](/en/documentation/products/guides/secure/create-waf-rule-set/).
3. Select the **Tuning** tab.
    - You'll find the available variables to filter.
4. Define the **time range** you want to analyze.
5. In the **Workloads** dropdown menu, select the workloads you want to analyze. This field is mandatory.
6. You can also choose to filter by **network list**.
7. Optionally, you can click the **+ Filter** button to filter by **IP Address** or **Country**
    - In this case, click the **Apply** button.

To exemplify a real-life situation, let's assume the existence of a few variables:

1. On **Time Range**, select **Last 12 hours**.
2. On **Workloads**, select `www.mydomain.com` and `www.anotherdomain.com`.
3. On **Network List**, select **Blocklist IPs**.

You'll receive a list of records regarding the filters you've applied. In this case, records that match the `Blocklist IPs` network list.

You can do a drilldown of the records by clicking on each of them with information on **Rule IDs**, **Hits**, **Paths**, **IPs**, **Countries**, **Top 10 IPs Address**, and **Top 10 Countries**.

</Fragment>

<Fragment slot="panel.consoledomains">

After setting up the initial configurations, proceed as follows:

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **WAF Rules**.
2. Select the WAF Rule Set you want to tune or [create a new one](/en/documentation/products/guides/secure/create-waf-rule-set/).
3. Select the **Tuning** tab.
    - You'll find the available variables to filter.
4. Define the **time range** you want to analyze.
5. In the **Domain(s)** dropdown, select the domains you want to analyze. Mandatory field.
6. You can also choose to filter by **network list**.
7. Optionally, you can click the **+ Filter** button to filter by **IP Address** or **Country**
    - In this case, click the **Apply** button.

To exemplify a real-life situation, let's assume the existence of a few variables:

1. On **Time Range**, select **Last 12 hours**.
2. On **Domain(s)**, select `www.mydomain.com` and `www.anotherdomain.com`.
3. On **Network List**, select **Blocklist IPs**.

You'll receive a list of records regarding the filters you've applied. In this case, records that match the `Blocklist IPs` network list.

You can do a drilldown of the records by clicking on each of them with information on **Rule IDs**, **Hits**, **Paths**, **IPs**, **Countries**, **Top 10 IPs Address**, and **Top 10 Countries**.

</Fragment>
</Tabs>
---

## Creating an Allowed Rule

Once you filter a query with WAF Tuning, you can create an [allowed rule](/en/documentation/products/secure/firewall/web-application-firewall/custom-allowed-rules/) from the presented results. To do so:

1. Use the **Field** chechbox to select the records you want to create an allowed rule.
    - You can select as many records as you want.
2. Click the **Allow Rules** button.

You can go to the **Allowed Rules** tab on the **WAF Rules** page to check the allowed rule was successfully created. All new requests to the specified domains in your configured firewall will be treated according to the newly added rules.

---