How can I detect false positives caused by AWS Managed Rules?

Resolution

First, identify the false positives caused by AWS Managed Rules. Then, use labels or a scope-down statement to add those false positives to your allow list.

Detect false positive errors from managed rule groups

Complete the following steps:

1. Under terminatingRuleId in your AWS WAF logs, find the manager rule group that blocks the legitimate request. The following is an example of an AWS WAF log:

   "timestamp": 1712236911743,
   "formatVersion": 1,
   "webaclId": "arn:aws:wafv2:us-west-2:***:regional/webacl/WAFtester/3c372***-***",
   "terminatingRuleId": "AWS-AWSManagedRulesCommonRuleSet",
   "terminatingRuleType": "MANAGED_RULE_GROUP",
   "action": "BLOCK",
   "terminatingRuleMatchDetails": [],
   "ruleGroupList": [{
   "ruleGroupId": "AWS#AWSManagedRulesCommonRuleSet",
   "terminatingRule": {
   "ruleId": "SizeRestrictions_BODY",
   "action": "BLOCK",
   "overriddenAction": "BLOCK",
   "ruleMatchDetails": null
   },
   "nonTerminatingMatchingRules": [],
   "excludedRules": null,
   "customerConfig": null
   }],

2. Under terminatingRule, find ruleId to identify the rule that blocks the legitimate request. For example: "SizeRestrictions_Body".

3. Identify the attribute or criteria that causes the false positive. For example, if a database admin runs stored procedures remotely, then their requests might contain a large volume of data. The ManagedRulesCommonRuleSet rule group blocks these requests due to the SizeRestrictions_Body rule.

Add false positives to your allow list

Configure the web access control list (web ACL) to allow the legitimate requests through the managed rule group that causes the false positive. To modify the managed rule group, use labels or use scope-down statements.

Note: It's a best practice to use labels for fine-grain explicit rules. The scope-down statement doesn't inspect requests that fall out of scope against all rules in a rule group.

Labels

Use labels added by AWS Managed Rules to prevent false positives. When you create custom rules that match requests with these labels, change the default action of the rules inside the managed rule group.

Complete the following steps:

1. Open the AWS WAF console, and then choose your AWS Region.
2. In the navigation pane, choose IP sets.
3. Create an IP set that contains the legitimate IP addresses to exclude from an inspection by a rule group.
4. Choose Web ACLs, and then choose your web ACL.
5. Under Rules, choose the rule group that causes the false positive error, and then choose Edit.
6. Choose the rule that causes the false positive error, and then set it to Count.
7. Choose Save rule.
8. Choose Add rule, and then choose Add my own rules and rule groups.
9. For Rule type, choose Rule Builder.
10. Enter a rule name.
11. For Type, choose Regular rule.
12. Set the If a request dropdown list to matches all the statements (AND).
13. Select the following parameters for Statement 1:
    For Inspect, choose Has a label.
    For Match scope, choose Label.
    Enter the label name for the rule that causes the false positive.
14. Select the following parameters for Statement 2:
    Turn on Negate statement results.
    For Inspect, choose Originates from an IP address in.
    For IP set, enter the IP set that contains the legitimate IP addresses.
    For IP address to use as the originating address, choose Source IP address.
15. For Action, choose Block.
16. Under Set rule priority, set the rule's priority to a lower priority than the AWS Managed Rules rule groups.
17. Choose Save.

Scope-down statement

Use a scope-down statement to narrow the scope of the requests that the rule or rule group evaluates. When you add a scope-down statement to a rule group, the requests can be inspected. The statement skips legitimate IP addresses that are included in the statement.

Complete the following steps:

1. Open the AWS WAF console, and then choose your Region.
2. Choose IP sets.
3. Create an IP set that contains the legitimate IP addresses to exclude from an inspection by a rule group.
4. Choose Web ACLs, and then choose your web ACL.
5. Under Rules, choose the AWS Managed Rule that you want to add a scope-down statement to, and then choose Edit.
6. Create the scope-down statement that excludes the IP set that you created. For example:
   For If a request, choose Doesn't match the statements (NOT)
   For Inspect, choose Originates from an IP address in
   For IP set, enter example-IP-set. Note: Replace example-IP-set with the IP address that you want to exclude
   For IP addresses to use as the originating address, choose Source IP address. Note: Replace Source IP address with your IP address.
7. Choose Save rule.