Managed Rulesets

Sectora-curated WAF rules covering OWASP CRS, emerging CVE signatures, and bot-platform abuse patterns. Updated weekly. Turn on, leave alone.

Available rulesets

OWASP Core (Paranoia 1)

Distillation of OWASP Core Rule Set, level 1 paranoia. Catches the broad attack classes: SQLi, XSS, path traversal, command injection, basic LFI. Very low FP rate; safe default.

OWASP Core (Paranoia 2)

Stricter version. Catches more variants of the same classes; some FPs on highly dynamic apps (multi-tenant SaaS dashboards). Enable in Log mode first.

CVE Signatures

Patterns for actively-exploited CVEs. Examples: log4shell, Spring4Shell, ProxyShell, Confluence CVE-2023-22515. Updated within 48h of public disclosure for major CVEs.

Credential Stuffing

Login endpoint patterns indicating large-scale stuffing — pre-loaded credential lists, IP rotation patterns, common attack tooling signatures. Pairs with leaked-credential check.

Scraping Protection

Patterns for aggressive scraping — too-fast pagination, missing referer chains, headless-browser signatures. Use Challenge action instead of Block — some scrapers are legitimate.

AI / LLM Abuse

Prompt-injection patterns, model-stealing query shapes, jailbreak attempts. Useful if you expose LLM-backed endpoints.

GraphQL Abuse

Introspection queries on prod endpoints, batched query DoS, deeply-nested query patterns.

Path Discovery

Common path-brute-force patterns (.git, .env, /admin, /phpmyadmin, etc.). Cheap to block — these never appear in legitimate traffic.

Configuration

Shield → site → Managed Rulesets. Toggle each ruleset on/off. Per-ruleset action setting: Log, Challenge, or Block.

Recommended default: turn ON OWASP Core Paranoia 1, CVE Signatures, and Path Discovery in Block mode. Add others as you grow comfortable.

Updates

Rulesets ship updates weekly (Sundays at 02:00 UTC). Critical CVE rules ship hot-patch within 48h of public disclosure. You get a Slack notification (Settings → Notifications → Managed Rule Updates) summarizing what changed.

Updates roll out to your tenant in Log mode for 24h before going Active. Anything that'd FP > 1% of your traffic is held back automatically until investigated.

Per-rule overrides

A single rule causing FPs in your environment? Open the rule from the analytics dashboard, click Disable for my site, leave a reason. The override persists across ruleset updates.

What's next