All Products
Search

This Product

    Web Application Firewall:Fine-tune web attack protection with custom rule groups

    Document Center

    Web Application Firewall:Fine-tune web attack protection with custom rule groups

    Last Updated:Sep 14, 2026

    If you find that the Web Application Firewall (WAF) RegEx Protection Engine incorrectly blocks legitimate requests to your website, create a custom protection rule group to prevent these false positives.

    Prerequisites

    Before you begin, make sure that you have:

    • A WAF instance using the subscription billing method

      • Chinese Mainland region: Business edition or higher

      • Outside Chinese Mainland region: Enterprise edition or higher

    • A website added to WAF. For more information, see Tutorial

    Background

    When the WAF RegEx Protection Engine causes a false positive, first identify the ID of the protection rule that triggered the block. Then, create a custom protection rule group for the affected website and remove the problematic rule to prevent WAF from blocking similar legitimate requests.

    Procedure

    1. Log on to the Web Application Firewall (WAF) console. In the top menu bar, select the resource group and region for your WAF instance: Chinese Mainland or Outside Chinese Mainland.

    2. In the left navigation pane, choose Security Operations > Security Reports.

    3. Find the rule ID of the protection rule that caused the false positive.

      1. Go to the Web Security > Web Intrusion Prevention report, select the affected domain, and then filter the attack logs to show only Protection Rules Engine records.

      2. In the list of Protection Rules Engine attack records, find the log entry for the false positive. You can filter by source IP address to locate the entry. Note its Rule ID.

    4. In the left-side navigation pane, choose Systems > Protection Rule Group.

    5. Create a custom protection rule group and remove the rule that caused the false positive.

      1. On the Web Intrusion Protection tab, find the rule group applied to the affected website.

        Note

        You can search for the affected domain name in the Website column to locate the target rule group.

        In the Action column of the target rule group, click Copy.

      2. Click Copy in the Actions column of the target rule group (assuming the Medium Rule Group is causing the false positive).

      3. On the Copy Rule Group page, change the Rule Group Name (for example, to "medium rule group-false positive fix"), enable Automatic Update, and click Save.

        After you save the settings, the new rule group appears in the protection rule group list. In this example, the group is named medium rule group-false positive fix and uses the medium rule group as a template. This confirms the copy was successful.

      4. Find the new custom rule group and click Modify in its Action column.

      5. On the Modify Rule Group page, use the Rule Group ID to search for the problematic rule, select it, and then click Remove Selected Rules.

        Important

        Before you remove a protection rule, confirm that it is causing the false positive.

      6. Click Save.

    6. Apply the custom protection rule group to your website.

      1. Find the custom rule group and click Apply to Website in its Action column.

      2. In the Apply to Website panel, add the affected domain to the Selected Websites section and click Save.

      After you apply the custom rule group, you can go to the Website Protection page to check the Protection Rules Engine settings for your domain. The Protection Rule Group will now be your custom group. For more information, see Configure the RegEx Protection Engine.

      When your website receives similar requests, WAF no longer blocks them.

      Note

      If legitimate requests are still blocked, you can repeat these steps to identify the new triggering rule ID and remove that rule from your custom protection rule group.