Preconfigured WAF rules overview

Google Cloud Armor preconfigured WAF rules are complex web application firewall (WAF) rules with dozens of signatures that are compiled from open source industry standards. Each signature corresponds to an attack detection rule in the ruleset. Google offers these rules as is. The rules let Cloud Armor evaluate dozens of distinct traffic signatures by referring to conveniently named rules rather than requiring you to define each signature manually.

Cloud Armor preconfigured WAF rules can be tuned to best suit your needs. For more information about how to tune the rules, see Tune Cloud Armor preconfigured WAF rules.

The following table lists the preconfigured preconfigured WAF rules available for use in a Cloud Armor security policy. These rules are based on the OWASP ModSecurity Core Rule Set (CRS), such as OWASP Core Rule Set 4.22 . We recommend using version 4.22 for the most up-to-date protection against modern threats. While support for CRS 3.3 and 3.0 is ongoing, we recommend avoiding older versions, especially CRS version 3.0, whenever your workloads allow for version 4.22.

In addition, the following cve-canary rules are available to all Cloud Armor customers to help detect and optionally block the following vulnerabilities:

• CVE-2021-44228 and CVE-2021-45046 Log4j RCE vulnerabilities
• 942550-sqli JSON-formatted content vulnerability
• google-mrs-v202512-id000001-rce and google-mrs-v202512-id000002-rce React RCE vulnerabilities

Best practices

To optimize your use of preconfigured WAF rules, consider the following best practices:

• Tuning and sensitivity: start with sensitivity level 1 in preview mode to understand how rules affect your application. For more information, see Choose your preconfigured WAF rule sensitivity level.
• Request body inspection limit: configure the inspection limit based on your needs. Cloud Armor preconfigured WAF rules can inspect up to 64 kB of the request body. For more information, see Update inspection limit for preconfigured WAF rules.
• Canary and stable rulesets: maintain canary rulesets in preview mode with a higher priority, and keep stable rulesets in enforced mode with a lower priority. This approach lets you validate rule changes before they affect your production traffic.

For a complete list of recommendations, see Cloud Armor best practices.

Preconfigured OWASP rules

Each preconfigured WAF rule has a sensitivity level that corresponds to a OWASP CRS paranoia level. A lower sensitivity level indicates a higher confidence signature, which is less likely to generate a false positive. A higher sensitivity level increases security, but also increases the risk of generating a false positive. By default, Cloud Armor runs at sensitivity level 4 and evaluates all signatures in a rule set once enabled.

SQL injection (SQLi)

The following table provides the signature ID, sensitivity level, and description of each supported signature in the SQLi preconfigured WAF rule.