Today I enabled Managed Rules for one of our websites. I put all Ruleset actions to “log” because I first wanted to check if there are no false negatives, in which there are it seems.
In the Events log I see this entry a lot:
Ruleset: Cloudflare OWASP Core Ruleset
Rule: 949110: Inbound Anomaly Score Exceeded
So, I thought, let’s disable this rule. Strangely, I cannot find this specific rule within the OWASP Core Ruleset when I click on “Browse rules” within the ruleset. There is no rule to be found with id 949110.
Rule: 949110 is the OWASP score itself, below that you will and extensive report of what rules where triggered and the score each one added to the overall threshold score.
When you check the event, please click Additional Logs
There you’ll see the actual ID of each rule and the score that contributed to the event.
Your score threshold setting can be changed going in Security → WAF → Managed rules → Cloudflare OWASP Core Ruleset on OWASP Anomaly Score Threshold.
Each time a score is higher than the threshold set there, the OWASP Action will be executed.
