KQL snippet: prepare evidence for a managed WAF rule exclusion
A short query to isolate rule, field, URI and examples before proposing a targeted WAF exclusion.
Read article
Tag
false-positive
3 articles connected to this technical signal.
Azure WAF: qualify a false positive before creating an exclusion
A practical method to analyze an Azure WAF block, isolate the rule involved, compare application evidence, and decide between a fix, a targeted exclusion, or a custom rule.
Read articleWAF and KQL: identify a false positive before creating an exclusion
A KQL analysis method to qualify an Azure WAF block, distinguish attack, noise and application false positive, then document the decision before any exclusion.
Read article