WAF Configurer

Download SKILL.mdGet Murage How skills work

Open source. macOS, Windows and Linux.

At a glance

What it is

Web Application Firewall configuration expertise covering OWASP Core Rule Set design, rate limiting rules, geo-blocking, bot detection, custom rules for application-specific attacks, logging and monitoring, false positive management, and WAF bypass prevention for protecting web applications at the network edge.

A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.

File: SKILL.md
Length: 543 lines1,887 words, about 9 min read
Category: Securityapplication security
Level: Advanced
License

More security skills.

The full skill.

The whole file, exactly as it downloads. Read it before you rely on it.

SKILL.md

543 lines · 1,887 words

Download

WAF Configurer

Overview

A Web Application Firewall (WAF) inspects HTTP/HTTPS traffic between clients and web applications, blocking malicious requests based on a set of rules. A WAF operates at Layer 7 (application layer) and provides defense-in-depth against injection attacks, XSS, and other web threats. This skill covers the configuration, tuning, and maintenance of WAFs in production.

WAF Architecture

Client -> CDN/Edge -> WAF -> Load Balancer -> Application
                      |
                      +-> Block/Allow/Challenge
                      +-> Log all decisions
                      +-> Rate limiting
                      +-> Bot detection

WAF Processing Pipeline:
1. IP Reputation check
2. Geo-blocking rules
3. Rate limiting
4. Bot detection
5. OWASP Core Rule Set
6. Custom application rules
7. Allow/block decision
8. Logging

Put this skill to work.

Questions.

What is the WAF Configurer skill?

How much does it cost?

Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.

Can I change it?

Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.

Give your first job to Murage.

Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.

Download Murage

No account needed · Runs on the AI plan you already pay for

Client -> CDN/Edge -> WAF -> Load Balancer -> Application | +-> Block/Allow/Challenge +-> Log all decisions +-> Rate limiting +-> Bot detection WAF Processing Pipeline: 1. IP Reputation check 2. Geo-blocking rules 3. Rate limiting 4. Bot detection 5. OWASP Core Rule Set 6. Custom application rules 7. Allow/block decision 8. Logging

Level	Description	False Positives	Detection	Use Case
PL1	Basic protection	Very low	Moderate	Default, most applications
PL2	Elevated	Low-moderate	Good	Applications handling sensitive data
PL3	Strict	Moderate-high	Very good	High-security applications
PL4	Maximum	High	Maximum	Requires extensive tuning

WAF Configurer

More security skills.

The full skill.

WAF Configurer

Overview

WAF Architecture

Put this skill to work.

Questions.

Give your first job to Murage.

Search murage.ai

WAF Configurer

More security skills.

The full skill.

WAF Configurer

Overview

WAF Architecture

Put this skill to work.

Questions.

Give your first job to Murage.

Create a bot and use this skill.

Ask Ember to create the bot

Open the bot’s skills

Find WAF Configurer and switch it on

Ask the bot for the job

About this skill.

OWASP Core Rule Set (CRS)

CRS Rule Categories

CRS Configuration

Paranoia Level Selection

Rate Limiting Rules

AWS WAF Rate Limiting

Rate Limiting Strategy

Geo-Blocking

Bot Detection

AWS WAF Bot Control

Custom Rules for Application-Specific Attacks

SQL Injection Custom Rules

Custom Business Logic Protection

Logging and Monitoring

WAF Log Structure

Monitoring Dashboards

False Positive Management

Detection and Tuning Process

Rule Exclusions

False Positive Documentation

WAF Bypass Prevention

Common Bypass Techniques to Defend Against

WAF Deployment Best Practices

When to Use

Output Format

Example

Edge Cases