F5 Rules for AWS WAF - Web exploits OWASP Rules

Our main use case for F5 Rules for AWS WAF  is for our APIs.

We use F5 Rules for AWS WAF  to block common attack patterns such as cross-site scripting and SQL injection. For example, when requests contain a certain payload in the headers, the firewall can block or count them before they reach the application or endpoints. We usually start in count mode, review logs for false positives, and move the rules to block mode once we are confident that we're not affecting legitimate users.

One unique way we use F5 Rules for AWS WAF  is as part of our firewall control deployment when we're deploying a new application or API.

In my opinion, the best features F5 Rules for AWS WAF  offers include fast protection by managed rules, easy implementation, senior vulnerability management, and the necessary scanning for our team, which can range from more standard to reactive, allowing us to wait for an answer while we're loading the problem on the firewall.

Mostly, I mean both easy implementation and customization. From the implementation side, it is a straightforward deployment.

F5 Rules for AWS WAF makes my team's life easier because they can focus on new features and not spend as much time reviewing security requirements. In this case, I can say that having the lock or control in the log is great.

One feature that we appreciate about F5 Rules for AWS WAF is the visibility through the AWS WAF  logs. I will also highlight that combining F5 Rules for AWS WAF Managed Rules with custom AWS  rules gives us a good balance for our specific applications.

F5 Rules for AWS WAF has positively impacted us by improving our web application security without adding too much operational overhead.

The main improvements we noticed with F5 Rules for AWS WAF include reducing malicious traffic, better visibility, and more confidence.

The workload decreases mainly in analyzing malicious traffic thanks to F5 Rules for AWS WAF.

I think F5 Rules for AWS WAF could be improved mainly around visibility, specifically having more actionable recommendations for false positives.

For example, when a request to a popular application is blocked, a recommendation can make it faster to decide whether it is good or bad. I would appreciate a stronger preview dashboard showing blocked requests, source IPs, and maybe a CI/CD example will help with the implementation.

The most useful change for F5 Rules for AWS WAF would be rule-level allow listing and exception management. For example, if a legitimate request is blocked by a rule, we should be able to see which rule is blocking it and have a recommended exception option to check the impact of allowing it. That will make false positive handling much faster and easier.

I have been using F5 Rules for AWS WAF for around five years.

F5 Rules for AWS WAF is stable and reliable in my experience.

F5 Rules for AWS WAF can work with multiple environments, and we can also create some custom rules when required.

I had to contact support once for a question about F5 Rules for AWS WAF. I remember it was a friendly and quick experience without any problem.

Before using F5 Rules for AWS WAF, we mainly used native AWS WAF  managed rules and some custom WAF rules. We switched because F5 Rules for AWS WAF gave us stronger managed security.

My experience with pricing, setup cost, and licensing for F5 Rules for AWS WAF was very straightforward because it's all included on the vendor's side.

We are just a customer of F5 Rules for AWS WAF, with no other business relationship with this vendor.

We noticed ROI with F5 Rules for AWS WAF. F5 Rules for AWS WAF includes a lot of content, so in this case, I will estimate it simplifies our life and reduces the security work on common web attack patterns.

My experience with pricing, setup cost, and licensing for F5 Rules for AWS WAF was very straightforward because it's all included on the vendor's side.

We evaluated other options before choosing F5 Rules for AWS WAF.

I would rate F5 Rules for AWS WAF a nine out of ten.

I chose nine out of ten because of the auto-update for new features and the preview log.

Regarding F5 Rules for AWS WAF's AI capabilities, I would say that it is not mainly an AI platform.

From a governance and security perspective, F5 Rules for AWS WAF is solid because we can manage rules, get notifications about rule updates, and see who made changes to the configuration, but I think that the governance could be more robust.

I want to continue with F5 Rules for AWS WAF.

For AI capabilities, I will not describe F5 Rules for AWS WAF as having them.

My advice for others looking into using F5 Rules for AWS WAF is to start with count mode, not block mode. I rate F5 Rules for AWS WAF a nine out of ten overall.

F5 Rules for AWS WAF  manages the security rule set by applying the rules and setting the block directly in AWS WAF  to provide advanced protection against web application attacks, bots, threats, and some known vulnerabilities. This enhanced security coverage protects our product against all OWASP Top 10 attacks.

F5 Rules for AWS WAF  has positively impacted our organization by empowering our security. The best thing is that we haven't noticed anything because of those rules applied, and we are secured.

Easy AWS  integration is one of the best features F5 Rules for AWS WAF  offers. The easy AWS  integration can be attached to existing AWS WAF  deployments within minutes and works with CloudFront application load balancers and APIs, which has improved our team's workflow.

The additional costs for F5 Rules for AWS WAF  are quite high, as F5 managed rules require a separate subscription on top of the standard AWS WAF charges; it would be great if it would be pre-integrated.

Some F5 rules groups consume significantly more AWS capacity units than comparable AWS managed rule sets, which can limit how many rule groups fit into web ACLs.

I have been working in my current field for three and a half years.

F5 Rules for AWS WAF is stable.

I rate the scalability of F5 Rules for AWS WAF at ten out of ten.

I never reached out to customer support because of no need, but I believe it's great.

I previously used a standard AWS rule set before switching to F5 Rules for AWS WAF. I evaluated a standard AWS managed rule set before upgrading to F5 Rules for AWS WAF.

I purchased F5 Rules for AWS WAF through the AWS Marketplace .

In the past few years, we have zero security incidents, indicating a return on investment.

My experience with pricing, setup cost, and licensing for F5 Rules for AWS WAF includes additional costs and high WCU consumption usage, so I'm not one hundred percent happy.

I rate F5 Rules for AWS WAF eight out of ten because of the improvement points I mentioned before. Regarding F5 Rules for AWS WAF's AI capabilities, I would say its governance and security are pretty high, so I give it a ten out of ten.

I would say the accuracy and reliability of output for F5 Rules for AWS WAF are pretty high, as it's based on the data from my account. The accuracy and reliability are based on data from my own AWS account.

I would recommend connecting it from the beginning instead of using standard AWS managed rule sets. My overall review rating for F5 Rules for AWS WAF is eight out of ten.

My main use case for F5 Rules for AWS WAF  is to strengthen our security posture for our public-facing application for one of our US-based clients hosted on AWS , enhancing protection against common web attacks without introducing significant operational complexity. A specific example of how we use F5 Rules for AWS WAF  for our public-facing application is that it allows us to quickly extend the native capability of AWS WAF , helping us detect and mitigate common threats such as SQL injection attempts, cross-site scripting, malicious bots, and exploitation techniques. This solution reduces the effort to maintain custom signatures while still providing strong security coverage.

The best features F5 Rules for AWS WAF  offers include the pre-managed rules which help us identify the kind of traffic we receive from the external side, enabling us to adjust the sub-order rules to block CAPTCHAs or challenges to distinguish between legitimate traffic and possible bots.

F5 Rules for AWS WAF  integrates seamlessly with our AWS WAF , protecting our application load balancer, and it provides automation benefits by incorporating F5 managed rules deployment into our infrastructure as code in our CI/CD pipeline. This reduces the operational burden on our security team by automatically addressing issues. F5 Rules for AWS WAF has positively impacted our organization by improving our security posture and reducing the operational efforts of our security team in managing WAF policies. After implementing F5 Rules for AWS WAF, we observed a reduction of approximately 60 to 70% in web application security incidents reaching our application team, particularly blocking common threats like bot traffic and SQL injections without impacting our downstream systems.

F5 Rules for AWS WAF could be improved with deeper integration with Infrastructure as Code  tools like Terraform  for simplification, as well as more AI-driven recommendations for rules tuning to reduce false positives and better dashboards for visibility at the CXO level.

I would appreciate more frequent rules updates and better documentation from F5.

I have been using F5 Rules for AWS WAF for almost two and a half years.

F5 Rules for AWS WAF is stable in my experience, providing comprehensive managed rules coverage and reducing operational overhead compared to the AWS  native managed rules.

F5 Rules for AWS WAF is well-scalable with our AWS WAF and native environments.

My experience with customer support for F5 Rules for AWS WAF is good, though I believe more detailed documentation for custom rules is needed.

I previously used Imperva before switching to F5 Rules for AWS WAF.

I purchased F5 Rules for AWS WAF through the AWS Marketplace .

After implementation, we saw a reduction of 40 to 50% in time spent by our security team, as the managed rule sets maintained by F5 significantly reduced the manual effort in administration while enhancing protection against common web attacks.

My experience with pricing, setup cost, and licensing has been fair, though it is an additional cost for customers seeking strong security coverage without needing separate WAF infrastructure.

We evaluated other options including Imperva and Cloudflare  before choosing F5 Rules for AWS WAF.

F5 Rules for AWS WAF has an accuracy of about 80 to 90% in blocking common threats, providing a good balance between security coverage and false positives.

I advise others looking into using F5 Rules for AWS WAF to clearly understand their application traffic and security requirements before deployment to add significant value, and to consider leveraging F5's threat intelligence managed rules while implementing automation in policy management. I rate this product an 8 overall.

F5 Rules for AWS WAF  is mainly used for securing web applications to protect against web attacks, including common web attacks like DDoS and SQL injection.

With a particular client use case, the client had a gateway or an app gateway into their application. F5 Rules for AWS WAF  was placed in front of that application so that it screens traffic coming in. This way, it serves as the first point of contact when a client makes a request to the application, offering the first level of protection for the application.

If the application is in development or you are trying to make the application only available to a specific set of people, you can streamline the rules in F5 Rules for AWS WAF  to allow only a certain IP address range.

F5 Rules for AWS WAF  offers very strong protection against common web attacks, including DDoS attacks. The rules are frequently updated on the WAF, and it provides enterprise-grade threat intelligence. This helps to proactively prevent threats even before they happen and reduces operational burden on the organization's part by reducing the need to set rules manually.

The automatic rule updates in F5 Rules for AWS WAF help because the team does not have to worry about keeping up to date with the latest threats that come up in the web space. F5 handles figuring out and updating the rules to match current threats. This eliminates the need to evaluate and spend time determining which rules need to be updated for better threat protection.

F5 Rules for AWS WAF has greatly helped to positively reduce operational burden because previously dedicated resources were required to update WAF rules. Although specific time metrics are not available, F5 Rules for AWS WAF has greatly reduced the resources allocated to putting in rules, freeing up those resources to handle other tasks and thereby helping to improve efficiency.

Employees' time has been saved with F5 Rules for AWS WAF. Without F5 Rules for AWS WAF, some employees would need to be put in charge of setting up the rules on the WAF and then updating them. Since those resources no longer need to be dedicated to that task, they can be moved to deal with other work, thereby helping to increase efficiency.

There are potential false positives in F5 Rules for AWS WAF that sometimes require tuning. If those false positives could be worked out of the system or reduced to a lesser number, that would be beneficial.

There is limited visibility into the proprietary rule logic in F5 Rules for AWS WAF. If documentation could be expanded more on the rule logic and how the system comes up with its rules, that would be very helpful.

While F5 Rules for AWS WAF is very good and works well, it is an additional cost beyond the regular AWS WAF . The limited visibility into the proprietary rule logic is also a bit of a drawback.

F5 Rules for AWS WAF has been used for about two years.

F5 Rules for AWS WAF is fairly stable, and I have not really encountered a lot of bugs or glitches.

In the AWS  cloud, F5 Rules for AWS WAF is fairly scalable, and scalability is at an acceptable level for what it is as a managed web application firewall.

I have not really had to use customer support for F5 Rules for AWS WAF very much, but from what I have heard, it is fairly good and up to standard.

Previously, AWS WAF  was manually updated by the team, and that was causing too much strain on the available human resources. This necessity led to the change to using F5 Rules for AWS WAF.

Pricing for F5 Rules for AWS WAF was fair for the going market rate. Setup was mostly seamless and not complicated. A good experience was had on that front.

Other options were not really evaluated before choosing F5 Rules for AWS WAF. What was wanted was known, and F5 Rules for AWS WAF checked all the boxes.

F5 Rules for AWS WAF's AI capabilities have not been interacted with much so far, but given the way the resource itself is structured, the security would be expected to be top-notch, and governance would be up to standard.

F5 Rules for AWS WAF has not been interacted with much, but from what has been heard from others, it is quite good and up to standard. It is good enough for the prevailing standard right now.

F5 Rules for AWS WAF is definitely recommended. It is a good tool for anyone to try and see if it matches their use case, and it is something that an organization can really benefit from. The overall review rating for F5 Rules for AWS WAF is seven out of ten.