WAF Managed ruleset log mode for subdomain only but not root domain

[kleung]

Type

Product improvement

Description

Separate Managed ruleset with Log action for being launched subdomain

Benefit

When customer has full DNS setup for whole domain with multiple subdomains are proxied, customer cannot verify if application impact will be happened when enable proxy for subdomain (e.g. sub1.example.com). Neither change the default action of Managed Rulesets for global, nor edit scope to control subdomain only. Admin cannot keep example.com and other subdomain being protected (Block), while going to test sub1.example.com with Log action.The benefit of this request is to review which managed rules would be violated/ hit in Security Analytics or Security Events.

[mcorreia]

Hi there,

You can either use the trace feature in your account (Account > “Trace”) to see what rules/features the request hits, or go to “Security” > “Events” and filter by hostname to see which firewall components hit in real-time:

Additionally, depending on your plan, you can also create a custom WAF rule with the action set simply as “Log”:

Take care.