Cisco Multicloud Defense User Guide

PDF

Cisco Multicloud Defense User Guide

Web Application Firewall (WAF) Profile

Updated: July 8, 2026

Want to summarize with AI?

Log in

Learn how a Web Application Firewall profile uses core, premium, or custom rules to detect and block common attacks against web applications.

Web protection profiles are a collection of Web Application Firewall (WAF) rules that can detect and block known web application attacks. You can configure WAF profiles to use signatures and constraints to examine web traffic. You can also enforce an HTTP method policy, which controls the HTTP method that matches the specified pattern. It typically protects web applications from attacks such as cross-site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection, among others.

Table 1. Supported WAF rule sets

Rulesets

Description

Core Rules

The core rules are a standard set of rules from ModSecurity CRS (Core Rule Set) that provide a base level of protection for any web application.

Trustwave Rules

The Trustwave rules are a premium set of rules from ModSecurity based on intelligence gathered from real-world investigations, penetration tests and research that provide an advanced level of protection for specific web applications and frameworks.

Custom Rules

The custom rules are a particular set of rules written by customers that provide a specialized level of protection for custom web applications.

Note that the WAF profile does not include malicious IPs. See Malicious IP Profile and Network Intrusion (IDS/IPS) Profile for more information.

Create WAF Profile

Use the following procedure to create a WAF profile.

Note

If core Rulesets are specified, the core rules cannot be disabled. In order to disable the core rules, remove all core rulesets from the WAF profile so they will not be evaluated.

Procedure

1.

Navigate to Policies > Profiles > WAF.
2.

Click Create.
3.

Specify the following general settings:

  1. Enter a unique Profile Name.

  2. (Optional) Enter a Description. This may help differentiate between profiles with a similar name.

  3. Specify the action:

    • Rule Default - Allow or deny the requests based on the action specified in each triggered rule and log an event.

    • Allow Log - Allow the requests and log an event.

    • Deny Log - Deny the requests and log an event.

  4. Specify whether to generate a Threat HAR file if the WAF profile detects malicious activity. The gateway should have a Pcap profile attached, for this to work.

  5. Specify whether to generate a HTTP Request HAR file if the WAF profile detects malicious activity.

  6. In the RULE SETS section, in the vertical tab located to the left, click Core Rules. You must specify at least one ruleset from a rules library (Core, Trustwave, Custom):

    • Specify the following:

      • Manual - Specify the core rules version to use.

      • Automatic - Specify the numbers of days from publish date to delay automatic update to the latest core rules version.

    • Identify the rules you want to add to the profile and click Add to Profile. The selections appear in the table located to the right.

  7. In the vertical tab located to the left, click Trustwave Rules.

    • Specify the following:

      • Disabled - Specify whether to disable the use of Trustwave rules.

      • Manual - Specify the Trustwave rules version to use.

      • Automatic - Specify the number of days from publish date to delay automatic update to the latest Trustwave rules version.

    • Identify the rules you want to add to the profile and click Add to Profile. The selections appear in the Profile Selections table located to the right.

  8. In the vertical tab located to the left, click Custom Rules.

    • Specify one of the following options:

      • Disabled - Specify whether to disable the use of custom rules.

      • Manual - Specify the custom rules version to use.

      • Automatic - Specify the number of days from publish date to delay automatic update to the latest custom rules version.

    • Identify the rules you want to add to the profile and click Add to Profile. The selections appear in the Profile Selectionstable located to the right.

4.

Scroll to the top of the window and click the Advanced Settings tab:

  1. Under "Rule Suppression", click Add to add one or more rows for rules. Rules can be suppressed for a specific IP or a list of CIDRs:

    • For Source IP/CIDR List, provide a comma-separated list of IPs or CIDRs.

    • For Rule ID List, provide a comma-separated list of rule IDs.

  2. Under "Event Filtering" provide the following information:

    • Type - Rate or Sample

    • Number of Events

    • Time (Seconds)

  3. Under "Rule Event Filtering" click Add to add one or more rows for rules. For every new row you create, enter a valid Rule ID List, Number of Events, Time (Sec), and choose either Type or Sample as the Type.

  4. Under "Core Rule Set", select a value for both the Request Anomaly and Response Anomaly. Note that using a value less than 3 for the "Request Anomaly" results in a huge volume of alerts.

  5. Select the Paranoia Level. Your options range from 1–4.
5.

Click Save.

What to do next

Attach the profile to a policy rule set. See Rule Sets and Rule Set Groups for more information.

Event Filtering

To reduce the number of security events that are generated when the WAF Profile is triggered, the Event Filtering under Advanced Settings can be configured to rate limit or sample the events. The configuration does not alter the detection or protection behavior.

When specifying Type as Rate, the generated events are rate limited based on the specified Number of Events triggered over a Time evaluation interval (in seconds). For example, if Number of Events is specified as 50 and Time is specified as 5 seconds, only 10 events per second will be generated.

When specifying Type as Sample, the generated events are sampled based on the specified Number of Events. For example, if Number of Events is specified as 10, only 1 event will be generated for every 10 events triggered.

Profile Event Filtering

Profile Event Filtering applies to all rules that are configured in the WAF Profile:

  • Specify the Type as Rate or Sample:

    • Rate- Specify the Number of Events and the Time evaluation interval (in seconds).

    • Sample- Specify the Number of Events.

Rule Event Filtering

To reduce the number of security events that are generated when the WAF profile is triggered, event filtering can be configured to rate limit or sample the events. The configuration does not alter the detection or protection behavior.

Rule event filtering applies to specific rules that are configured in the WAF profile.

Procedure

1.

Click Add under Rule Event Filtering.
2.

For Rule ID List, specify a comma-separated list of Rule IDs.
3.

Specify Type as Rate or Sample.

  • Rate- Specify the Number of Events and the Time evaluation interval (in seconds).

  • Sample- Specify the Number of Events.

What to do next

Associate WAF Profile with a Policy Rule