Fortinet Managed Rules for AWS WAF - SQLi/XSS

What do you like best about the product?

The biggest advantage is the combination of strong security coverage and ease of management. The preconfigured rules make it much easier to protect AWS workloads against common threats such as SQL injection, XSS, and known exploits without having to build and maintain everything from scratch. The integration with AWS WAF is straightforward, and the managed updates help keep protection aligned with new threats. Overall, it saves time while providing an additional layer of security for web applications and APIs.

What do you dislike about the product?

The main downside is that the rules can sometimes require tuning to avoid false positives, especially for applications with custom traffic patterns. It would also be helpful to have more detailed documentation and clearer guidance for fine-tuning rules for specific workloads. Pricing can also become a consideration as the number of protected resources grows.

What problems is the product solving and how is that benefiting you?

Fortinet Managed Rules for AWS WAF helps us protect our web applications and APIs from common attacks without having to create and maintain WAF rules ourselves. It provides consistent security coverage against threats like SQL injection, XSS, and other known exploits while reducing the time we spend on security rule management. This lets our team focus more on application and infrastructure work while still maintaining a strong security posture.

What do you like best about the product?

The main reason we use Fortinet's managed rules is how easily they plug into our existing AWS setup to cover core security risks like SQL injection and cross-site scripting. Building and updating custom WAF rules by hand takes way too much time, so having Fortinet's team handle the threat intelligence and signature updates behind the scenes saves a massive headache. It gives our public-facing APIs a solid baseline defense right out of the box without forcing us to spend hours tweaking custom logic every time a new vulnerability drops.

What do you dislike about the product?

The biggest issue is dealing with false positives when you first turn the rules on. If you jump straight to blocking mode, legitimate traffic or unusual API payloads will definitely get caught and blocked. You end up having to run everything in Count mode for a while, dig through CloudWatch logs, and set up override rules to fix the false alarms before you can actually enforce blocks. Another downside is the lack of visibility into the actual underlying rule logic. Because the signatures are proprietary black boxes, troubleshooting why a specific request got flagged takes more time than it should. On top of that, cost can accumulate quickly if you are running these rules across high-traffic Application Load Balancers, since AWS charges for rule evaluations alongside the subscription cost.

What problems is the product solving and how is that benefiting you?

It solves the hassle of keeping web endpoints and open APIs safe from bad traffic, web scrapers, and common attack vectors without forcing us to build or patch security rules by hand. Because Fortinet handles threat signatures automatically, new vulnerabilities are covered right away, saving us from constantly checking security advisories just to tweak firewall settings. The biggest win for us is cut-down workload. We get solid, hands-off security built right into our cloud setup, which lets us put our time toward building features instead of sifting through network logs to craft custom filter rules. It simply gives us a dependable safety net for our web apps without adding extra day-to-day maintenance.

What do you like best about the product?

The automated threat intelligence powered by FortiGuard Labs is the biggest win for our team. We use the Fortinet OWASP Top 10 and Known Bad Inputs/Bots Rulesets on our public-facing ALBs. Instead of constantly monitoring new CVEs and manually writing complex regex rules in-house, the rule sets are updated automatically in the background. It effectively neutralizes SQLi, XSS, and automated vulnerability scanner probes without adding latency to our applications.

What do you dislike about the product?

While the protection is robust, diagnosing occasional false positives can be challenging due to the 'black-box' nature of managed rules. When a legitimate multi-step API request containing complex JSON payloads gets blocked, AWS WAF logs show the rule group and rule ID, but not the exact string or parameter that triggered the match. We have to spend extra time cross-referencing logs and writing custom label-based exception rules. It would be a huge improvement if Fortinet/AWS could provide more granular trigger explanations or context directly in the logs to speed up root-cause analysis.

What problems is the product solving and how is that benefiting you?

Before implementing Fortinet Managed Rules, our security team struggled with manually tracking new CVEs and writing custom regex rules for our AWS WAF, which consumed 6–8 engineering hours each week and left a window of vulnerability during zero-day events. By switching to Fortinet Managed Rules, we now have automated, continuously updated threat intelligence applied directly to our CloudFront and ALB distributions. This has eliminated the operational overhead of rule maintenance, cut our vulnerability triage time by roughly 70%, and ensured our public-facing APIs are consistently shielded against OWASP Top 10 threats and automated exploit probes.

What do you like best about the product?

I appreciate the simplicity of usage for Fortinet Managed Rules for AWS WAF. It doesn't need much maintenance and does its job simply, which is really crucial as we are a small team of developers. It saves us time because we don't have to deal with keeping up with signature updates, and it helps manage the noise from the internet that isn't always a direct threat but can use up unnecessary capacity. I like that we can apply the group rule only where it makes sense, rather than globally, which saved a lot of time and pain.

What do you dislike about the product?

I find the rules confusing as I don't always know why something was blocked. I get an ID and label but have to infer the intent. Also, I think the documentation is pretty thin, which could definitely be improved.

What problems is the product solving and how is that benefiting you?

I save time with Fortinet Managed Rules for AWS WAF, avoiding signature management. It simplifies usage with minimal maintenance and allows rule application only where needed, reducing unnecessary resource use.

Recommendations to others considering the product:

Consider enhancing the documentation to provide clearer explanations of rule actions and intents. This could help users better understand why certain actions are taken and improve overall user experience.

What do you like best about the product?

What I like best about Fortinet Managed Rules for AWS WAF is how easy it is to strengthen application security without having to build and maintain every rule manually. The managed rules provide broad coverage against common web application threats, are regularly updated to address emerging vulnerabilities, and integrate smoothly with AWS WAF. This saves time for security teams while providing reliable protection and reducing the effort required for ongoing rule management.

What do you dislike about the product?

One area that could be improved is the cost, especially for larger environments with multiple applications and AWS accounts. Some rules may also require tuning to reduce false positives and fit specific application requirements. More detailed documentation, clearer rule explanations, and easier troubleshooting would make it simpler to fine-tune the rules and understand why specific requests are being blocked.

What problems is the product solving and how is that benefiting you?

Fortinet Managed Rules for AWS WAF helps us protect our web applications from common threats such as SQL injection, cross-site scripting, bots, and other malicious traffic without having to create and maintain all the security rules ourselves. The managed rules reduce the operational effort required for WAF management, improve our overall security posture, and help us respond to emerging threats more quickly. This allows our security team to focus more on higher-value security initiatives while maintaining consistent protection across AWS-hosted applications.

What do you like best about the product?

I like that Fortinet Managed Rules for AWS WAF enhances firewall protection, blocking threats before they reach the application and defending against common web attacks and known CVEs. I find the integration with AWS SNS really useful because it provides real-time updates to admins, letting them quickly respond to updates. Integrating Fortinet with AWS WAF is super easy, and the documentation is helpful.

What do you dislike about the product?

I think they have everything that is needed. I dont have any dislike points to be mentioned

What problems is the product solving and how is that benefiting you?

I use Fortinet Managed Rules for AWS WAF to enhance firewall protection, blocking threats and common web attacks before they reach my application. It provides robust safety against AI-driven threats, offers seamless AWS integration, and sends real-time updates for immediate action.

What do you like best about the product?

I like using it as one of the AWS services to protect what I run on AWS, such as applications deployed on EC2 and assets stored in an S3 bucket. It also helps me set up security measures in advance, before requests reach my apps.

What do you dislike about the product?

I’d say there’s something I dislike: if I had to, I would disconnect myself from the service and let requests hit my app through AWS WAF as a proxy for protection.

What problems is the product solving and how is that benefiting you?

This AWS WAF service helps me improve my cybersecurity measures by reducing suspicious requests to my applications hosted on AWS S3 bucket, where I keep sensitive assets.

What do you like best about the product?

Honestly the best part is not having to write my own rules — it just covers the OWASP Top 10 and bots out of the box, and the rules update themselves.

What do you dislike about the product?

Mainly the UI. Policy management isn't the most intuitive, and the reporting side could be a lot better.The dashboard could be simplerBit of a learning curve at the start too.

What problems is the product solving and how is that benefiting you?

Mainly blocking common web/API attacks like SQL injection and bots. The big win is I'm not writing or maintaining custom rules — it updates itself, scales automatically.

What do you like best about the product?

What I like best is the combination of **strong, continuously updated threat protection and ease of management**. Fortinet’s managed rules add protection against common web and API attacks, including OWASP Top 10 threats, SQL injection, XSS, known exploits, CVEs, and malicious bots, while the rules are regularly updated through FortiGuard Labs. This reduces the amount of time and effort required to maintain WAF rules manually.

What do you dislike about the product?

The main drawback is that managed rules can sometimes be **too broad or generate false positives**, requiring additional tuning and exclusions for specific applications. It would also be helpful to have more granular visibility into why a particular rule triggered and simpler customization options without increasing the management overhead.

What problems is the product solving and how is that benefiting you?

Fortinet Managed Rules for AWS WAF help reduce the effort required to protect our web applications and APIs from common threats such as SQL injection, XSS, and known exploits. The continuously updated rules reduce manual rule maintenance, improve our security coverage, and help our team respond to emerging threats more quickly while saving time on WAF management.

What do you like best about the product?

It’s a library of preconfigured, ready-to-use signatures and rules that makes security protections extremely easy to deploy and maintain. These rules are updated regularly to ensure up-to-date security. To be specific they help to secure API from injection attacks (CSS. CEVs, etc)

What do you dislike about the product?

Rules can become complex to set up, and the UI doesn’t really help, which makes management and enrolling new personnel difficult. Also, these rules can only be applied to WAS apps/services.

What problems is the product solving and how is that benefiting you?

It helped us harden our API by applying a preconfigured OWASP Top 10 ruleset. As a result, we were able to align with security standards and best practices, making our API connections/integrations and management more secure. Also, performance was not impacted.