WAF Protection Policies Must Have Rules Configured

Rule Details

**Table 1** Rule details
Parameter	Description
Rule Name	waf-policy-not-empty
Identifier	WAF Protection Policies Must Have Rules Configured
Description	If no rules are added for a WAF protection policy, this policy is non-compliant.
Tag	waf
Trigger Type	Configuration change
Filter Type	waf.policy
Rule Parameters	None

Application Scenarios

WAF protection policies help you defend against common web application attacks, including XSS attacks, SQL injection, crawlers, and web shells. You can customize protection rules to let WAF better protect your website services using these custom rules.

This Config rule checks whether WAF protection policies are configured with valid rules.

Solution

Configure rules for your WAF protection policies, such as anti-crawler rules, private data masking rules, and web tamper protection rules. For details, see the Protection Configuration Overview.

Rule Logic

If WAF protection policies are configured with any protection rules, the check result is compliant.
If no rules are configured for WAF protection policies, the check result is non-compliant.

This rule only checks custom WAF protection policies, and does not check built-in WAF protection rules, such as basic web protection, bot protection, and anti-crawler.

Parent topic: Web Application Firewall

Previous topic: Protection Policies Must Be Configured for Domain Names Protected with WAF

Next topic: WAF Instances Must Be Enabled to Protect Domain Names