Skip Filter Rule - Que son los esos ID que se excluyen en una WAF

Hi AnthonyCastillo,

Thank you for reaching out to Sophos Community.

Refer to the article below to get more information on "WAF filter rules"

support.sophos.com/.../KB-000035562

Search heading: Infrastructure rules

Hola Yash, si lo he revisado pero quisiera saber en que me afecta que yo omita ese filtro, además quisiera saber que son las reglas de infraestructura.

Hi AnthonyCastillo,

The WAF rule ID 949110 is one of the infrastructure rules, and I'd not add it to the skip list. They’re core to the operation of the WAF ModSecurity. You should not turn off these rules without possibly affecting other rules that are built upon these rules. If an infrastructure rule is added to the Skip filter rules list, you make yourself vulnerable to other possible attacks.

Try to find the rule id that detected the anomaly from the reverseproxy logs and if the score is less than 5, add the rule id in the skip list.

Thanks,

Thanks H_Patel

How can I solve this problem?

I would like your help please

Thanks,

Hi AnthonyCastillo,

Try to find the rule ID that detected the anomaly from the reverse proxy logs and ensure that it's not an infrastructure rule before adding that to the skip list. If you need help with finding the rule ID, replicate the logs while you replicate the issue and send me the via personal message. 

Thanks,