waf-rule-management

What problem does it solve?

This Skill empowers developers and security professionals to efficiently write, validate, test, tune, and improve ModSecurity/Coraza WAF rules and OWASP CRS configurations, significantly reducing manual effort and enhancing web application security posture.

Core Features & Use Cases

• Rule Development: Write new detection rules, positive security rules from OpenAPI specs, and virtual patches for CVEs.
• Validation & Testing: Syntax check rules, lint regex for ReDoS, and run comprehensive regression tests locally with go-ftw against ModSecurity and Coraza.
• Tuning & Optimization: Analyze audit logs, generate narrow exclusions for false positives, and manage paranoia levels and anomaly scoring.
• Use Case: A security engineer needs to quickly create a virtual patch for a newly disclosed CVE affecting their ModSecurity WAF. They use this Skill to scaffold an incident workspace, write the virtual patch rule, test it against ModSecurity and Coraza using go-ftw, and then assemble it into the active WAF configuration.

Quick Start

Use the waf-rule-management skill to write a new ModSecurity rule to block SQL injection attempts targeting the '/api/users' endpoint.