Microsoft AzureOverview
Detection-only mode provides visibility but does not block attacks. Prevention mode is required for stronger protection on internet-facing workloads.
Remediation guidance
Azure Remediation
Service-Wide (Recommended)
Apply Azure Policy to require WAF-enabled Application Gateway with Prevention mode.
Azure Portal (Asset-Level)
- Open Application Gateway.
- Associate a WAF policy if missing.
- Set WAF mode to Prevention.
Azure CLI (Asset-Level)
az network application-gateway waf-policy policy-setting update --resource-group <resource-group> --policy-name <waf-policy-name> --mode Prevention
References
- https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview
Query logic
These are the stored checks tied to this control.
Application gateways without WAF prevention mode
Connectors
Microsoft Azure
Covered asset types
ApplicationGateway
Expected check: eq []
{ applicationGateways(where: { OR: [ { wafEnabled: false }, { wafMode_NOT: "Prevention" } ] }) { ...AssetFragment } }
